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INTRODUCTORY 

Farasrapb 

Preliminary remarks ...— ___ 1 

General remarks upon the nature of cryptographic periodicity. . .. 2 

Effects of varying the length of the plain-tevt groupings..— - 3 

Primary and secondary periods, resultant periods -- 4 


1 Preliminary remarks —a The text immediately preceding this devoted itself almost 
exclusively to polyalphabetic substitution systems of the type called repeatmg-key ciphers 
It was seen how a regularity m the employment of a limited number of alphabets results in the 
mamfestation of periodicity or cychc phenomena m the cryptogiam, by means of which the 
latter may be solved The difficulty m solution is directly correlated with the type and number 
of cipher alphabets employed m specific examples 

b Two piocedurcs suggest themselves foi consideiation when the student cryptanalyst 
realizes the foregoing ciicumstances and thinks of methods to elnmnate the weaknesses mherent 
in this cryptographic system First, noting that the difficulties m solution mcrease as the 
length of the key mcreases, he may study the effects of employing much longer keys to see if 
one would be warranted m placmg much tiust m that method of increasmg the security of the 
messages Upon second thought, hoi evei, rei lembermg tl at as a general rule the first step 
m the solution consists m ascertaining the number of alphabets employed, it seems to him that 
the most logical thmg to do would be to use a pioteduio which wdl avo»d periodicity altogether, 
will thus eliminate the cyclic phenomena that aie nonnally manifested m cryptograms of a 
penodic construction, and thus prevent an enemy cryptanalyst from takmg even a first step 
toward solution In other woids, he will mvestigale the possibihties of apenochc systems first 
and if the results ate unsatisfactoiy, he wdl then see what he can do with systems usmg lengthy 
keys 

c Accordmgly, the first part of this text wdl be devoted to an exammation of certam of the 
very simple varieties of aperiodic, polyalphabetic substitution systems, after this, methods of 
extendmg or lengthening short mnemomc keys, and systems using lengthy keys wdl be studied 

2 General remarks upon the nature of cryptographic periodicity —a When the thoughtfid 
student considers the matter of penodicity m polyalphabetic substitution systems and tries to 
ascertam its real nature, he notes, with some degree of mterest and surprise perhaps that it is 
composed of two fundamental factors, because there are m reality two elements mvolved m its 
production He has, of course, become qmte familiar with the idea that periodicity necessitates 
the use of a keyu^ element and that the latter must be employed m a cychc manner But he 
now begms to realize that there is another element mvolved, the significance of which he has 
perhaps not fully appreciated, viz, that unless the key is apphed to constant-length plam-text 
groups no periodicity wdl be manifested externally by the cryptogram, despite the repetitive or 
cyclic use of a constant-length key This realization is quickly followed by the idea that possibly 
all periodicity may be avoided or suppressed by either or both of two ways (1) By usmg constant- 
length keymg umts to encipher vanable-length plam-text groupings or (2) by using vanable- 
length keymg umts to encipher constant-length plam-text groupmgs 

b The student at once reahzes also that the periodicity exhibited by repeatmg-key ciphers 
of the type studied m the precedmg text is of a very simple character There, successive letters 
of the repetitive key were apphed to successive letters of the text In respect to the employment 
of the key, the cryptographic or keying process may be said to be constant or fixed m character 
This termmology remains true even if a smglp keying umt serves to encipher two or more letters 
( 1 ) 














at a time, proi^ded only that the groupmgs of plam-text letters are constant in length For 
example, a single key letter may serve to encipher two successive plam-text letters, if the key is 
repetitive m character and the message is sufficient in length, periodicity wiU still be manifested 
by the cryptogram and the latter can be solved by the methods mdicated in the precedmg text ‘ 
Naturally, those methods would have to be modified m accordance with the specific type of 
pouping involved In this case the factormg process would disclose an apparent key length 
twice that of the red length But study of the frequency distnbutions would soon show that 
the 1st and 2d distributions were similar, the 3d and 4th, the 5th and 6th, and so on, depending 
upon the length of the key The logical step is therefore to combme the distnbutions in proper 
pairs and proceed as usual 

+ 1 , ^ encipherment by constant-length groupmgs, the apparent length of 

the penod (as found by applymg the factormg process to the cryptogram) is a multiple of the 
red length and the multiple corresponds to the length of the groupmgs, that is, the number of 
plam-text letters enciphered by the same key letter 

d The point to be noted, however, is that all these cases are stfil penodic m character, 
because both the keying umts and the plam-text groupings are constant m length 

3 Effects of varying the length of the plam-text groupmgs—a But now consider the effects 

of making one or the other of these two elements vanahle m length Suppose that the plam-text 
groupmgs are made yanable m length and that the keying umts are kept constant m length 
then, even though the key may be cychc m character and may repeat itself many times m the 
course of encipherment, external periodicity is suppressed, unless the law governing the variation 
in plain-text groupys is vtself cyclic in character^ and the length of the message is at least two or 
more times that of the cycle applicable to this variable grouping 

1 example, suppose the correspondents agree to use reversed standard cipher 

dphabets with the key word SIGNAL, to encipher a message, the latter bemg divided up mto 
groups as shown below 

ALSIG NALSI G 

C OM MAN DING GENER A LF IRS TARM YHASI S SU EDO RDER SEFFE 

fi UW UGT KFAH UWNWJ L HN MS NGPU PGNVF I TR OPE RFER OCBBC 

^als ignal sign a L 

i ^ ^234 12345 1 12 123 1234 12345 

T ll III NOO NDIR ECTIN G TH ATT ELEP HONES 

L HS QHS WOFZ KDARQ N NU NMM YIDU OQZKF C NZ NUU WPWL EXYHT 

SIG N A LSI 
1 12 123 1234 12345 1 12 123 

C OM MAS WITC HBOAR D SC OMM 

Q UW UGO RFUL TZMAJ I AQ UWW .. 


TKFAH UWNWJ LH NAR QN GPU PGNVF ITROP ERFER 

LHSQH SWOFZ K DARQ N NUNM MYIDU OQZKF CNZNU 

UWPWL EXYHT QUWUG ORFUL TZMAJ lAQUW W 


> In this connection, see Section III, Military Cryptanalysts, Part If 
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(2) The cipher text m this example (Fig 1) shows a tetragraphic and a pentagraphic 
repetition The two occurrences of QUWUG (= COMMA) are separated by an mterval of 90 
letters, the two occurrences of ARQN ( =IRST) by 39 letters The former repetition (QUWUG), 
it will be noted, is a true periodic repetition, smce the plain-text letters, their groupmg, and 
the key letters are identical The mterval m this case, if counted m terms of letters, is the 
product of the keying cycle, 6, by the groupmg cycle, 15 The latter repetition (ARQN) is not 
a true periodic repetition m the sense that both cycles have been completed at the same point, 
as is the case m the former repetition It is true that the cipher letters ARQN, representing 
IRST both times, are produced by the same key letters, I and G, but the enciphermg points m 
the groupmg cycle are different m the two cases Repetitions of this type may be termed 
partially periodic repetitions, to distinguish them from those of the completely penodic type 

c When the intervals between the two repetitions noted above are more carefully studied, 
especially from the pomt of view of the mteractmg cycles which brought them about, it will be 
seen that counting according to groupings and not according to smgle letters, the two pentagraphs 
QUWUG are separated by an mterval of 30 groupmgs Or, if one prefers to look at the matter m 
the hght of the keymg cycle, the two occurrences of QUWUG are separated by 30 key letters 
Since the key is but 6 letters m length, this means that the key has gone through 5 cycles Thus, 
the number 30 is the product of the number of letters m the keymg cycle (6) by the number 
of different-length groupmgs m the grouping cycle (5) The mteraction of these two cycles 
may be conceived of as pai taking of the nature of two gears which are m mesh, one driven by 
the other One of these gears has 6 teeth, the other 5, and the teeth are numbered If the 
two gears are adjusted so that the “number 1 teeth” aie adjacent to each other, and the gears 
are caused to revolve, these two teeth will not come together again until the larger gear has 
made 5 revolutions and the smaller one 6 During this time, a total of 30 meshings of mdividual 
teeth will have occurred But smce one revolution of the smaller gear (=the groupmg cycle) 
represents the encipherment of 15 letters, when translated m terms of letters, the 6 complete 
revolutions of this gear mean the encipherment of 90 letters This accounts for the penod of 
90, when stated m terms of letters 

d The two occurrences of the other repetition, ARQN, are at an mterval of 39 letters, but 
m terms of the number of mtervenmg groupings, the mterval is 12, which is obviously two 
times the length of the keymg cycle In other words, the key has m this case passed through 2 
cycles 

e In a long message enciphered accordmg to such a scheme as the foregomg there would 
be many repetitions of both types discussed above (the completely penodic and the partially 
penodic) so that the cryptanalyst might encounter some difficulty m his attempts to reach a 
solution, especially if he had no mformation as to the basic system It is to be noted m this 
connection that if any one of the groupings exceeds say 5, 6, or 7 letters m length, the scheme 
may give itself away rather easily, smce it is clear that vnthin each grouping the encipherment u 
strictly monoalphabetic Therefore, m the event of groupmgs of more than 5 or 6 letters, the 
monoalphabetic eqmvalents of tell-tale words such as ATTACK, BATTALION, DIVISION, 
etc , would stand out The system is most efficacious, therefore, with short groupmgs 

/ It should also be noted that there is nothing about the scheme which reqmres a regularity 
m the groupmg cycle such as that embodied m the example A lengthy groupmg cycle such as 
the one shown below may just as easily be employed, it bemg guided by a key of its own, for 
example, the number of dots and dashes contained m the International Morse signals for the 
letters composmg the phrase DECLARATION OF INDEPENDENCE might be used Thus, A ( _) 
has 2, B (_...) has 4, and so on Hence 

DECLARATIONOFINDEPENDENCE 

3144232123331223141231241 
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The grouping cycle is 3+1+4+4+2 . or 60 letters m length Suppose the same phrase 

IS used as an enciphenng key for determining the selection of cipher alphabets Smce the 

o?2Ta^r60^r be the least common multiple 

of 25 and 60 or 300 letters Tlus system might appear to yield a very high degree of crvpto- 
^aphic sec^ity But the student will see as he progresses that the security is not so hi^ as 
he may at first glance suppose it to be j » ugu as 

4 . Primary and secondary periods, resultant periods -a It has been noted that the length 
of the complete period m a system such as the foregomg is the least common multiple of the 
length of the two component or mteractmg periods In a way, therefore, smce the component 
f may be designated as the basvc oTpnmary 

periods These are aJ^ hidden or latent peiiods The apparent or patent penod, that is the 
complete penod, may be designated as the secondary or resultant period In certain types of 

periods which mteract to prodLe a 
resultant penod, also, there are cases m i^hich the latter may inteiact with another piimary 
penod to produce a tertiary penod, and so on The or resultant, or apparent period is tS 

Sr^v or Zv T ^ repetitions 

1 Jus may or may not be broken down mto its component primary periods 

mto Its component primary penods, the readmg of many messages pertaimng to a widespread 

IZ' mi, ' ^ ciyptographic scheme has been icduced to its simplest 

sZZ f discovery of a maltiphcity of simple elements which mteract m 

successive cryptographic strata 


Section II 


SOLUTION OF SYSTEMS USING CONSTANT-LENGTH KEYING UNITS TO ENCIPHER 
VARIABLE-LENGTH PLAIN-TEXT GROUPINGS, I 

Pangnph 


Introductory remerks . - ... .5 

Aperiodic encipheiment produced by groupings according to word lengths . _ . . . 6 

Solution when direct standard cipher alphabets an employed ....— . 7 

Solution when rcveised standard cipher alphabets are employed... 8 

Comments on foitgoirg casoc . ft 


5. Introductory remarks— a The system desenbed m p.uagraph 3 above is obviously not 
to be classified as aponodio in nature, despite the injection of a vaiiable factor which mthat 
case was based upon irieguiauty m the length of one of the two elements mvolvod m poly alpha¬ 
betic substitution The vanable factor was there subject to a law winch m itself was ponodic 
in character 

b To make such a system tiuly aperiodic m character, by elaborating upon the basic 
scheme for produen-g vauable-length plam-text groupmgo, would be possible, but impractical 
For example, using the same method as is given in paragraph 3/ foi detennmmg the lengths of 
the groupings, one might employ the text of a book, and if tbe latter is longer than the message 
to be enciphered, the cnTtogram would certamly show no periodicity as regards the mtervals 
between repetitions, which would be plentiful However, as already indicated, such a scheme 
would not be very practical for regular commumcation between a large number of correspondents, 
for reasons which are no doubt apparent The book would have to be safeguarded as would a 
code, enciphenng and deciphemig would be quite slow, cumbersome, and subject to erroi, 
and, unless the same key text weie used for all messages, methods or indicators would have to 
be adopted to show exactly where encipheiment begins m each message A simpler method 
for produemg constantly changing, apcnodic plam-text groupmgs therefore, is to be sought 
6 Aperiodic enc’pherment produced by groupings accordmg to word lengths— a The 
simplest method for produemg aperiodic plam-text groupmgs is one which has doubtless long 
ago presented itself to the st ident, viz , encipherment accordmg to the actual word lengtlis of 
the message to be enciphered 

b Although the average number of letters composmg the words of any alphabetical language 
IS fairly constant, successive words compnsmg plain text vaiy a great deal m this respect, and 
this variation is subject to no law * In tel^aphic English, for example, the mean length of 
words is 5 2 letters, the words may confcam from 1 to 15 or more letters, but the successive 
words vary m length in an extremely irregular maimer, no matter how long the text may be 
c As a consequence, the use of word lengths for determuung the number of letters to be 
enciphered by each key letter of a repetitive key commends itself to the mexpeiienced cryptog¬ 
rapher as soon as he comes to imdcrstand the way m which repeatmg-key ciphers are solved 
If there is no periodicity in the cryptograms, how can the letters of the cipher text, written m 

‘ It ]s true, of course, that the diffcrencps botwten two vsnters in respect to the lengths and characters of 
the words contained in their personal vocabrlaiics are oft^'n marked and can be measured These d fEercnces 
may be subject to certain laws, but the latter arc not of the. type m which we are inteiested, being psycho’ogical 
rather than mathematical m character See Rickert, E , New Metitods for the Study of Literature, University of 
Chicago Press, Chicago, 1927 


( 5 ) 
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5-letter groups, be distributed into their respective monoalphabets’ And if this very first step 
IS impossible, how can the cryptograms be solved’ 

7 Solution when direct standard cipher alphabets are employed — a Despite the foregoing 
rhetorical questions, the solution of this case is really quite simple It merely involves a modifi¬ 
cation of the method given in a previous text,* wherein solution of a monoalphabetic cipher 
employing a direct standard alphabet is accomplished by completing the plam-component 
sequence There, all the words of the entire message come out on a smgle generatrix of the 
completion diagram In the present case, smce the individual, separate words of a message 
are enciphered by different key letters, these words wdl reappear on dxferent generatrices of the 
diagram All the cryptanalyst has to do is to pick them out He can do this once he has found 
a good startmg point, by using a little imagmation and following clues afforded by the context 
h An example will make the method clear The followmg message (note its brevity) has 
been intercepted 


T R E C S 
S V A G R 


Y G E T I 
X U X P W 


L U V W V 
V M T U C 


I K M Q I 
S Y X G X 


R X S P J 
V H F F B 


L L B H G 


c Submittmg the message to routme study, the first step is 
and try out the possibility of direct standard alphabets having 
diagram for the first 10 letters of the message is shown m figure 2 
d Despite the fact that the text does not all reappear on the 
same generatrix, the solution is a very simple matter because the 
first three words of the message are easily found CAN YOU GET 
The key letters may be sought in the usual manner and are found 
to he REA One may proceed to set up the remaining letters of 
the message on sliding normal alphabets, or one may assume 
various keywords such as READ, REAL, REAM, etc , and try to 
contmue the decipherment in that way The former method is 
easier The completed solution is as follows 

read E R S 

CAN YOU GET FIRST REGIMENT BY RADIO 
TRE CSY GET ILUVW VIKMQIRX SP JSVAG 
D I G E S T 

OUR PHONE NOW OUT OF COMMISSION 

RXU XPWVM TUC SYX GX VHFFBLLBHG 

e Note the key in the foregomg case It is composed of the 
successive key letters of the phrase READERS DIGEST 

/ The only difficult part of such a solution is that of makin g 
the first step and gettmg a start on a word If the words are 
short it is rather easy to overlook good possibilities and thus 
spend some time m fruitless searching However, solution must 
come, if nothmg good appears at the beg inning of the message, 
search should be made in the mterior of the cryptogram or at 
the end 


to use normal alphabet stnps 
been used The completion 

T R E C S Y GET I 
USFDTZHFUJ 
VTGEUAIGVK 
WUHFVBJHWL 
XVIGWCKIXM 
YWJHXDLJYN 
ZXKIYEMKZO 
AYLJZFNLAP 
BZMKAGOMBQ 
CAN L B H P N C R 
DBOMCIQODS 
ECPNDJRPET 
FDQOEKSQFU 
GERPFLTRGV 
HFSQGMUSHW 
IGTRHNVTIX 
JHUSIOWUJY 
KIVTJPXVKZ 
LJWUKQYWLA 
MKXVLRZXMB 
NLYWMSAYNC 
OMZXNTBZOD 
P N A YOU CAPE 
QOBZPVDBQF 
RPCAQWECRG 
SQDBRXFDSH 


Military Cryptanalysis, Part I, Par 20 
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8. Solution when reversed standard cipher alphabets are employed —It should by this time 
hardly be necessary to mdicate that the only change m the procedure set forth in paragraph 
7c, d m the case of reversed standard cipher alphabets is that the letters of the cryptogram must 
be converted mto their plam-component (direct standard) equivalents before the completion 
sequence is apphed to the message 

9. Comments on foregomg cases —a The foregoing cases are so simple m nature that the 
detailed treatment accorded them would seem hardly to be warranted at this stage of study 
However, they are necessary and valuable as an mtroduction to the more complicated cases to 
follow 

h Throughout this text, whenever encipherment processes are under discussion, the pair 
of enciphermg equations commonly referred to as charactenzmg the so-called Vigenfere method 
will be understood, unless otherwise mdicated This method mvolves the pair of enciphermg 
equations eiA= 0 k/ 2 , 0 p/i= 0 c/ 2 , that is, the mdex letter, which is usually the mitial letter of the 
plain component, is set opposite the key letter on the cipher component, the plam-text letter 
to be enciphered is sought on the plain component and its equivalent is the letter opposite it 
on the cipher component ® 

c The solution of messages piepared accordmg to the two preceding methods is particularly 
easy, for the reason that standard cipher alphabets are employed and these, of course, are derived 
from known components The significance of this statement should by this time he quite 
obvious to the student But what if mixed alphabets are employed, so that one or both of the 
components upon which the cipher alphabets are based are unknown sequences? The simple 
procedure of completing the plain component obviously cannot be used Smce the messages 
are polyalphabetic in character, and smce the process of factormg cannot be applied, it would 
seem that the solution of messages enciphered m different alphabets and accordmg to word 
lengths would be a rather difficult matter However, it will soon be made clear that the solution 
IS not nearly so difficult as first impression might lead the student to imagme 

• See m this connection, Military Cryptanalysis, Part lit Section II, and Appendix 1 
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10 Solution when the original word lengths are retained in the cryptogram —a This case 
will be discussed not because it is encountered in practical military cryptography but because it 
affords a good introduction to the case in which the original woid lengths are no longer m evi¬ 
dence m the cryptogi am, the latter appearmg m the usual 5-letter groups 

h Reference is made at this point to the phenomenon called idiomorphism, and its value in 
connection with the application of the prmciples of solution by the “probable-word” method, 
as explained in a previous text * When the original word lengths of a message are retained m 
the cryptogram, there is no difficulty in searchmg for and locating idiomorphs and then mnlriTig 
comparisons between these idioraorphic sequences in the message and special word patterns 
set forth in lists man tamed for the purpose For example, in the following message note the 
underhned groups and study the letters within these groups 


Message 


XIXLP EQVIB VEFHAPFVT RT XWK PWEWIWRD X M 
NTJCTYZL OAS XYQ ARVVRKFO NT BH SFJDUUXFP 
OUVIGJPF ULBFZ RV DKUKff R Q H R 0 Z 

InlOMOHPHIC SlQUENCES 

(1) P W^W I W R D (2) A R y , ^V R KFONT (3) SFJDUUXFP 


(4) R 0 H R 0 Z 


c Reference to lists of words commonly found in military text and arranged accordmg to 
their idiomorphic patterns or formulae soon gives suggestions for these cipher groups Thus 


(1) 

PWEWIWRD 

D 0 N 

(3) 

S F J 
ART 

D U U X F P 
I L L E R Y 

(2) 

ARVVRKFONT 

B A T,jT A L I 0 N S 

(4) 

R 0 H 
0 C L 

R 0 Z 

0 C K 


i Military Cryptanalysis, Part I, Par 33 a-d, incluMve 
( 8 ) 


d With these assumed equivalents a reconstruction skeleton or diagram of cipher alphabets 
(fonmng a portion of a quadxicular table) is established, on the hypothesis that the cipher 
alphabets have been deuved from the sliding of a mixed component against the normal se¬ 
quence First it IS noted that since 0p=Rc both m the woid DIVISION and in tlie woid OCLOCK 
their cipher equivalents must be in the same alphabet The leconstiuction skeleton is then as 
follows 



e Noting that the interval between 0 and R m the first and second alphabets is the same, 
direct symmetry of position is assumed In a few moments the first alphabet m the skeleton 
becomes as follows 



IIOUFS 36 

/ The key word upon which the nuxed component is based is now not difficult to find 
HYDRAULIC 

g (1) To decipher the entire message, the simplest procedure is to convert the cipher 
letters mto their plain-component eqmvalents (setting the HYDRAULIC Z sequence against 
the normal alphabet at any point of comcidence) and then completmg the plain-component 
sequence, as usual The words of the message will then reappear on different generatrices The 


















SjS iowr“^““‘''"• 


-ABCDEFGHIJKLMNOPQRSTUVWXY! 

-HYDRAUL X CBEFGJ KMN OPQE TVffXI 


X I X L P 
Y H Y G S 
Z I Z H T 
A J A I U 
B K B J V 
C L C K W 
D M D L X 
ENEMY 

Ap=So 


E Q V I B 
K T W H J 
L U X I K 
M V Y J L 
N W Z K M 
0 X A L N 
P Y B M 0 
Q Z C N P 
R A D 0 Q 
S B E P R 
T C F Q S 
U D G R T 

V E H S U 
W F I T V 
X G J U W 

Y H K V X 
Z I L W Y 
A J M X Z 
B K N Y A 
C L 0 Z B 
D M P A C 
E N Q B D 
FORCE 

Ap=Uo 


vefhapfvt 

WKLAESLWV 

XLMBFTMXW 

YMNCGUNYX 

ZNODHVOZY 

aopeiwpaz 

BPQFJXQBA 
CQRGKYRCB 
DRSHLZSDC 
E S T I M A TED 


as ^ SUPREME COURT and the complete message is 

Solution 

am FORCE ESTIMATED AS ONE DIVISION OF INFANTRY Am T»0 

XIXLP eqvib vefhapfvt rt x»k pwewiwrd xm ntjS x?^ 

RTS u PREM 

BATTALIONS OF ARTILLERY MARCHING NORTH AT SEVEN OCLOCK 
ARWRKFONT BH SFJDUUXFP OUVIGJPF ULBFZ RV DKUKW ROHROZ 

is the reversed normal sequence, the procedure is no different 
aftS the cS I “ completion diagram the reversed sequence is employed 

after the cipher letters have been converted mto their plam-component equivalents 

t student realizes from his previous work that once the primary mixed 

sZZS! ' recovered the latter becomes a knovm sequence and that ?he soltion of 
employmg the same set of derived alphabets, even though the keys to 
mdmdual messages are different, then becomes a simple matter 
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11 Solution when other types of alphabets are employed —a The foregoing examples 
mvolve the use either of standard cipher alphabets or of mixed cipher alphabets produced by 
the sUding of a mixed component agamst the normal sequence There is, however, nothing 
about the general cryptographic scheme which prevents the use of other types of derived, 
interrelated, or secondary mixed alphabets Cipher alphabets produced by the sliding of a 
imxed component agamst itself (either direct or reversed) or by the shdmg of two different 
mixed components are very commonly encountered m these cases 

b The solution of such cases mvolves only shght modifications m procedure, namely, those 
connected with the reconstruction of the pnmary components The student should be in a 
position to employ to good advantage and without difficulty what he has learned about the 
prmciples of mdirect symmetry of position m the solution of cases of the kind described 

c The solution of a message prepared with mixed alphabets derived as mdicated in sub- 
paragraph b, may be a difficult matter, depending upon the length of the message in question 
It might, of course, be almost impossible if the message is short and there is no background for 
the apphcation of the probable-word method But if the message is quite long, or, what is 
more probable with respect to military communications, should the system be used for regular 
traffic, so that there are available for study several messages enciphered by the same set of 
alphabets, then the problem becomes much easier In addition to the usual steps m solution 
by the probable-word method, gmded by a search for and identification of idiomoi*phs, there is 
the help that can be obtained from the use of the phenomena of isomorphism, a study of which 
forms the subject of discussion m the next paragraph 

12. Isomorphism and its importance m cryptanalytics .—a The term idiomorphism is 
famihar to the student It designates the phenomena arismg from the presence and positions 
of repeated letters m plam-text words, as a result of which such words may be classified according 
to their compositions, “patterns," ox Jormulae The term isomorphism (from the Greek “isos” 
meamng “equal” and “morphe” meamng “form”) designates the phenomena arismg from the 
existence of two or more idiomorphs with identical formulae Two or more sequences which 
possess identical formulae are said to be isomorphic 

b Isomorphism may exist m plain text or in cipher text For example, the three words 
WARRANT, LETTERS, and MISSION are isomorphic If enciphered monoalphabetically, their 
cipher eqmvalents would also be isomorphic In general, isomorphism is a phenomenon of 
monoalphabeticity (either plam or cipher), but there are instances wherein it is latent and can 
be made patent m polyalphabetic cryptograms 

c In practical cryptanalysis the phenomena of isomorphism afford a constantly astonishing 
source of clues and aids m solution The alert cryptanalyst is always on the lookout for situations 
in which he can take advantage of these phenomena, for they are among the most mterestmg 
and most important m cryptanalytics 

13. Illustration of the use of isomorphism —a Let us consider the case discussed under 
paragraph 10, wherem a message was enciphered with a set of mixed cipher alphabets denved 
from shdmg the key word-mixed primary component HYDRAULIC XZ agamst the normal 
sequence Suppose the message to be as follows (for snnplicity, ongmal word lengths are 
retamed) 

Cryptogram 

VCLLKIDVSJDCI ORKD CFSTV IXHMPPFXU E V Z Z 
F K N A K F 0 R A DKOMP ISE CSPPHQKCLZKSQ L P R 0 
J Z W B C X HOQCFFAOX R 0 Y X A N 0 EMDMZMTS 
TZFVUEAORSL AU PADDERXPNBXAR IGHFX JXI 
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b (1) Only a few minutes inspection discloses the following three sets of isomorphs 


(a) VCLLKIDVSJDCI 
(1) (b) CSPPHQKCLZKSQ 


P A D D E I 
r T 


C P N B X 

jU 

A R 

Ml 

1 

ij 


1 

□ 



1 

L- 



(a) IXHMPPFXU 
(2) (b) H 0 Q C F F A 0 X 


f(a) N A K F 0 R A 

(3) (b) R 0 Y X A N 0 


(2) Without stopping to lefer to woid-pattern lists m an attempt to identify the very 
striking idiomorphs of the first set, let the student pioceed to build up partial sequences of 
equivalents, as though he were dealmg with a case of indirect symmetiy of position Thus * 
From isomorphs (1) (a) and (1) (b) 


VOC, COS. LOP, KOH, lOQ, DoK, SOL, JOZ, 
from which the followmg partial sequences are constructed 


(a) VCSLP (b) DKH (c) IQ (d) JZ 
From isomorphs (1) (b) and (1) (c) 

COP, SoA, PoD, HOE, QoR, KOX, LoN, ZoB, 
from which the following partial sequences arc constructed 


(e) CPD (f) SA (g) HE (h) QR (i) KX (j) LN (k) ZB 
From isomorphs (1) (a) and (1) (c) 


VOP, CoA, LOD, KOE, lOR, DOX, SoN, JOB, 
from which the followmg partial sequences are constructed 

a) LDX (m) VP (n) CA (o) KE (p) IR (q) SN (r) JB 

Notmg that the data from the three isomorphs of this set may be combined (VCSLP and CPD 
make VCSLP D, the latter and LDX make VCSLP D X), the followmg sequences are 
established 

(1) {v C S L 

(2) {i Q 

(3) {j Z 

c (1) The fact that the longest of these chams consists of exactly 13 letters and that no 
additions can be made from the other two cases of isomorphism, leads to the assumption that a 
“half-cham” is here disclosed and that the latter represents a decimation of the ongmal primary 

123456789 

component at an even mterval Notmg the placement of the letters V S P N K , 
» The symbol O is to be read “is equivalent to ” 


6 6 7 8 9 10 II 12 13 

PANDKH XE 

s 
R 
6 
B 
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which gives the sequence the appearance of bemg the latter half of a keyword-mixed sequence 
running m the reversed direction, let the half-cham be reversed and extended to 26 places, as 
follows 

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 2S 26 

E KNPSVXHDALC 

(2) The data from the two partial chams (JZ B and IQ R) may now be used,and the 
letters mserted mto their proper positions Thus 

1 2 3 4 6 6 7 8 9 10 11 12 13 14 U 16 17 18 19 20 21 22 23 24 25 26 

E JK N PQS V XZH DRA LICB 

(3) The sequence H DRA L I C soon suggests HYDRAULIC as the key word When 

the mixed sequence is then developed m full, complete corroboration will be found from the data 

of isomorphs 2 (a) (b) and 3 (a) (b) Thus 

1 2 8 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 

HYDRAULICBEFGJKMNOPQSTVWXZ 

(4) From idiomorphs (2) (a) and (2) (b), the mterval between H and I is 7, it is the sannA 
for 0 and X, Q and H, C and M, etc From idiomorphs (3) (a) and (3) (b) the mterval between 
R and N1813, it IS the same for 0 and A, YandK, etc 

d The message may now be solved qmte readily, by the usual process of converting the 
cipher-text letters mto their plam-component eqmvaJents and then completing the plam com¬ 
ponent sequences The solution is as follows 

[Key STRIKE WHILE THE IRON IS (HOT?)] 

S T R IK 

COMMUNICATION WITH FIRST ARTILLERY WILL 

VCLLKIDVSJDCI ORKD CFSTV IXHMPPFXU EVZZ 

E W H I L E 

BE THROUGH CORPS AND COMMUNICATION WITH 

FK NAKFORA DKOMP ISE CSPPHQKCLZKSQ LPRO 

T H E I 

SECOND ARTILLERY THROUGH DIVISION 
JZWBCX HOQCFFAOX ROYXANO EMDMZMTS 

R 0 N IS 

SWITCHBOARD NO COMMUNICATION AFTER TEN 
TZFVUEAORSL AU PADDERXPNBXAR IGHFX JXI 

e (1) In the foregoing illustration the steps are particularly simple because of the followmg 
circumstances 

(a) The actual word lengths are shown 

(b) The words are enciphered monoalphabetically by different alphabets belonging to a 
set of secondary alphabets 

(c) Bepetitions of plam-text words, enciphered by different alphabets, produce isomorphs 
and the lengths of the isomorphs are defimtely known as a result of circumstance (a) 

(2) Of these facts, the last is of most interest m the present connection But what if the 
actual word lengths are now shown, that is, what if the text to be solved is mtercepted m the 
usual 5-letter-group form? 

138922—89-2 
















Section IV 


General remarks - 

Word separators . _ , ’ ’ ' - .. ”^14 

Variations and concluding remarks on foregoing systems . . 

the cryptanalyst has ^ “®P“ticulaily easy to solve because 

m±tary cryptography this is seldom or ne^ er the c^a "" 

what more difficult by leason of the fact tbnt tl.nro +v, * Problem is therefore made some- 
encipherment by successive keyletters However ^ the^ ^/dicate deSmtely the limits of 

penmentation m this case than m the preceding necessitates more ex- 

repetitions which may serve to “block out” or d^mut ^ust take careful note of 

will be able to find and identify cSrLque^^^^^^^^ 'f 

terns, such as those noted above If there is nlentv of t f ^anu^w idiomoiphic features or pat- 
to permit of employing this entering wedge ^ ^ ^ repetitions will be sufficient m number 

and affoids a quick soluL; FrexLpirs™ ^ T " ^ ^ 

number, tbesolution is piobabty i^lll under wa^ ^'^o^ds TO YOm 

ascertaimng the exact lengtTof sequZ“f wLh 1 The proces7of 

termed, “blockmg out isomoiphs” becomes a more Process is briefly 

rather tenuous threads of reasomng JFor example taS f 

withandletitbeassumedthatitwaaarrangedmSJeSe^^^^^^ dlustrative message just dealt 

UEVZZ PKMAK FORAD TVIXH MPPFX 

LZKSQ LPROJ ZWBCX Hnnri SECSP PHQKC 

matter There is no 

(1) VCLLKIDVSJDCI 

(2) CSPPHQKCLZKSQ 

(3) PADDERXPNBXAR 

( 14 ) 
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since the first one happens to be at the beginning of the message and its left-hand boundary, or 
“head,” is marked by (or rather, comcides with) the begmnmg of the message By a fortunate 
circumstance, the nght-hand boundary, or “toil,” can be fixed just as accurately That the 
repetition extends as far as mdicated above is certain for we have a check on the last column 
1. Q. R If an additional column were added, the letters would be 0, L. I Smce the second 
letter has previously appeared while the first and third have not, a contradiction results and the 
new column may not be included 

If, however, none of the three letters 0, L, I had previously appeared, so that there could 
be no means of getting a check on their i orrectness, it would not be possible to block out or 
ascertom the extent of the isomorphism m such a case All that could be said would be that 
it seems to mdude the first 13 letters, bui it might continue jurth&r 

d (1) However, the difficulty or even the impossibility of blocking out the isomorphs fo 
their JuU extent is not usually a senous matter After all, the cryptanalyst uses the phenomenon 
not to identify words but to obtam cryptanolytic data for reconstructing cipher alphabets 
For example, how many data are lost when the illustrative message of subparagraph 13o is 
rewritten m 5-letter groups as in subparagraph 14c (1)? Suppose the latter form of message 
be studied for isomorphs 

VCLLK IDVSJ DCI QR KDCFS TVI XH MPPFX UEVZZ 

FKNAK FORAD KOMPI S ECSP PHQKC LZKSQ. LPROJ 

ZWBCX HOQCF FAOX R OYXAN OEMDM ZMTST ZFVUE 

AORSL A OPAD DERXP NBX AR IGHFX JXI 

(2) If the imderscored sequentes are compared with those ui the message in subparagraph 
I3a, it will be found that only a relatively SiUall amount of mfonnation has been lost Certainly 
not enough to cause any difiitulty have been lost m this case, for all the data necessary for the 
reconstruction of tne mixed cipher component came from the first set of isomorphs, and the 
latter are identical m length m both cases Only the head and tail letters of the second pair 
of isomorphic sequences are not included m the underscored sequences m the 6-letter version 
of the message The third pair of isomorphic sequences shown m paragiaph 135 does not appear 
m the 5-letter version smce there is only one repeated letter in this case In long messages or 
when there are many short messages, a study of isomorphism will disclose a sufficient number of 
partial isomorphs to give data usually sufficient for puiposes of alphabet reconstruction 

c It should be noted that there is nothing about the phenomenon of isomorphism which 
restricts its use to cases in which the cipher alphabets are secondary alphabets resulting from 
the shdmg of a mixed component against the normal It can be useful m all cases of interrelated 
secondary alphabets no matter what the basis of their denvation may be 

/ In subsequent studies the important role which the phenomenon of isomorphism plays 
m cryptanalytics will become more apparent When the traffic is stereotypic m character, 
even to a shght degree, so that isomorphism may extend over several words or phrases, the 
phenomenon becomes of highest importance to the ciyptanalyst and an extremely valuable tool 
m his hands 

15 Word separators —a One of the practical difficulties m employmg systems m which the 
keying process shifts aocordmg to word lengths is that m bandlmg such a message the deciypto- 
graphing clerk is often not certom exactly when the termination of a word has been reached, 
and thus time is lost by him For mstance, while decryptographing a word such as INFORM 
the clerk would not know whether he now has the complete word and should shift to the next 
key letter or not The word imght be INFORMS. INFORMED, INFORMING, INFORMAL. INFOR- 
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NATION, etc The past tense of rerbs, the plural of nouns, terounatzons of various sorts 
capable of being added to word roots woidd give rise to diflSiculties, and the latter would be 
especially troublesome if the messages contained a few telegraphic errors Consequently, a 
scheme which is often adopted to circumvent this source of trouble is to mdicate the end of a 
word by an infrequent letter such as Q or X, and encipbenng the letter In such usage these 
letters are called wori separc^ors: 

b When word separators are employed and this fact is once discovered, their presence is 
of as much aid to the cryptanalyst in bis solution as it is to the clerks who are to decryptograph 
the messt^es Sometimes the presence of these word separators, even when enciphered, aids 
or makes possible the blocking out of isomorphs 

16 Vanations and concluding remarks on foregoing systems —a The systems thus far 
described are all based upon word-length encipheiment using different cipher alphabets Words 
are markedly irregular m r^ard to this feature of their construction, and thus apenodicity is 
imparted to such cryptograms But vanations m the method, aimed at makmg the latter 
somewhat more secure, are possible Some of these variations will now be discussed 

b Instead of enciphering according to natural word lengths, the irregular groupmgs of the 
text may be regulated by other agreements For example, suppose that the numencal value 
(m the normal sequence) of each key letter be used to control the number of letters enciphered 
by the successive cipher alphabets Depending then upon the composition of the key word or 
key phrase, there would be a varying number of letters enciphered m each alphabet If the 
key word were PREPARE, for instance, then the first cipher alphabet would be used for 16 
(Pssl6) letters, the second cipher alphabet, for 18 (s=R) letters, and so on Monoalphabetic 
encipherment would therefore allow plenty of opportunity for toll-tale word patterns to manifest 
themselves m the cipher text Once an entering wedge is found in this manner, solution would 
be achieved rather rapidly Of course, all types of cipher alphabets may be employed m this 
and the somewhat similar schemes described 

e li the key is short, and the massage is long, periodicity will be manifested m the crypto- 
ff^am, BO that it would be possible to ascertain the length of the basic cycle (m this case the length 
of the key) despite the irregular groupings m encipherment The determination of the length 
of the cycle might, however, present difficulties m some cases, smce the basic or fundamental 
penod would not be clearly evident because of the presence of repetitions which are not penodic 
m thejT ongm For example, suppose the word PREPARE were used as a key, each koy letter 
being employed to encipher a number of letters corresponding to its numerical value in the 
normal sequence It is clear that the lei^th of the basic penod, m terms of letters, would here 
be the sum of the numencal values of P (=16)-fR (=18) -f- E (—&), and so on, totallmg 79 
letters But because the key itsdf contains repeated letters and because encipherment by each 
key letter is monoalphabetic there would be plenty of cases in which the first letter P would 
encipher the same or part of the same word as the second letter P, producmg repetitions m the 
cryptogram The same would be true as regards encipherments by the two R's and the two 
E'fl in this key word Consequently, the basic penod of 79 would be distorted or masked by 
apenodic repetitions, the intervela between which would not be a function of, nor bear any 
relation to, the length of the key The student will encounter more cases of this kind, m whidi 
a fundamental periodicity is masked or obscured by the presence of cipher-text repetitions not 
attnbutable to the fundamental cycle The expeneneed cryptanalyst is on the lookout for 
phenomena of this type, when he finds in a polyalphabetic cipher plenty of repetitions but with 
no factorable constancy which leads to the disclosure of a short period He may conclude, then, 
either that the cryptogram mvolves several pnmaiy periods which interact to produce a long 
resultant penod, or that it involves a fairly long fundamental cycle within which repetitions of a 
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plam-text groupings is the case m w^ch ^e ^oj.ftime, thus breaking up what might 

that a given cipher alphabet is m y Y example, suppose the letters 

otherwise appear as fr^uency order, were eet off mto four groups, as 

of the alphabet, arranged m their normal-frequency orner, w 

followa 


E T R I N 0 D L 0 HR R G » V 

W SupZ’tat a UUar r^up 1 

group 2, «mt two lottois -nU be M DIREOTION OF THE Om^ 

phrase were used as a ^ EXTENSION COURSES Suppose, fioa^y, that each 

SIGNAL OFFICER FOR USE WITH ®^^^XTpher alphab^^ 

groupmgs 


_ - , - 9112 3 12111 3 12 

Groupmg- prEP ARED UNDERTHBD 

Key- ^ S T DIV IS I 0 NW ILL A DV A N C EAT F ^ 

- m S ^ ^ ^ » E ™ S H » AHQ « CT 

Otb'B'”*-. IREOTIOSO FTHEC H I.. 

B F I - B K HA » ^ 0 • 

Cipher-* 


be counteracted by the short the second tame it occurs it is enciphered 

word DIVISION occurs it is enciphered as THJ ’ . . same sequence of 

as RPRNPCKS Before DIVISION can be twice P between the two occurrences of the 
letters, an mterval of at least phras6=140), end then the chancy 

word (the sum of the values of the letters of the k y P ol thew 

the key letter P would begm ,^e of cipher equivalents the 

three possible enciphermente will p^^^^ample, if the text xvere such as to place t^ 

"r oir p^s^ri™ b.ow, eu^pbonu.. 

be as follows its »ii» 

PREP ARED UN 
PREP AREDUN DI VI SI ON... 

fir S T DIV IS I 0 N TH ZG T P NM ... . 

THJ GV F X M ^ 


















DIVISION, on its second appearance, begins but one letter beyond the place 
fv, appearance, the cipher equivalents now agree only m the first two 

letters, the fourth, and the last letters Thus 

D_I VISION 

(1) THJGVFXM 

(2) TJl Z G T P N M 

19 ^ected to the characteristics of the foregoing two encipherments of the 
same word When they are superimposed, the first two cipher equivalents are the same m the 
two encipherments, then there is a single mterval where the cipher equivalents are different, 

intervals with dissimilar cipher equiva- 
last cipher equivalent is the same m both cases The repetitions here extend 
meL 1 ^ only exceptionally Tlie two encipher- 

”““1 <^^nadences, that is, places where the cipher letters are identical, 
fflor^VOT, the dtslnbuhon of the comcidences is qmte irregular and of an intermittent character 
w! interrmttent cmntndences, involving comcidences of smgle letters 

mtS ^f sequences (r^Iy ever exceedmg pentagraphs) is one of the character- 

f ^ polyaJphabetic substitution, wherein the ciyptograms commonly 

manifest what appears to be a disturbed or distorted penodicity ^ 

arstlfT standpoint, the cryptographic principle upon which the foregomg 

U practical usage it is entirely too slow and too subject 

f were mechanized by machineiy, and if the enciphering 

mLhT t mechanism becomes of practical importance Cipher 

machmes for accomphahmg this type of substitution will be treated m a subsequent text 
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simple methods of climmatiiig or avoiding penodicity by poS 

of the olam text using constant-length keying units In paragraph 2a, however, it was pointed 
out th^t pcnodKity fan also be suppressed by applying keLg 

stant-leiurtu nlam-tc\t groups One such method consists m irregularly iniermptmg the keying 

orprearLge^nl. for mdieetog or detemumng the mtemrptone my he 

adopted Three methods will be mentioned in the next paragraph methods of 

IB Methods of mtermptmg a cyclic keying sequence—a Theie aie many metnoas 

into three categones as regards what happens after the mten uption occurs 
into ,tops and begins again at tl^ 

(2) One or more olt the elcmenlB m the keying wqnroce may be omitted from tone to tune 

“^^^Bie keying a'qnence irreglimlj alternate, m Ita direetlon of progreeaon, mtJ. or 

'"T’S‘me^'"ma°y, te'‘5rty, he mpreeented graphleeU, ee Mows Soppo» the 
key eonsHts ol a oycho sequence 1 1 10 dements represented s, mhoh^y hy the ooriM of 
12 3 10 Using an asterisk to indicate an interruption, the foUowmg may then repre^ 

I 'reUn Utw^e letter nnmber of the message and the element number of the keymg 
sequences m the three types mentioned above 


(Letter No. 1 2 S d 5 6 7 8 » 

“i--21 22*5 2l'2l 28 27 28 29 30 31 32 

b"::: IV;r,%; irn.;" 55 ^. 

.3r'i2'5i^2’3“ir"2; % s ^lo h s “ 

sr;;;;;., i- *- o-io- 1 - 2-.- 0- 6 - 7-.- 9-10- 1 -*- o- o- 7- ete 
a») 
























( 3 )fey element NoV.'”’.''' l-2-34-5-*-4-3 20 

^iLetter No... 21 22 2^ oa or ® 9~10- 1-MO- 9- 8- 7-*- 8 

fcydementis;;;;;:;;; ?.ta..!?- ^9 “ 1 

lO-dement keying eeqnenee, for ezemple, ooul/be ^tS*™ th* ’7“*? ‘ 

sequence and the matter could then be h^dled aa thnf w 18-element 

the w ^^eiiiTth^tC^rry'te^p'r;::^" »* 


T7- , Method (1) 

Keymg element No.. 1 2 3 4 .«: r -7 o n 

Letter No. — 2 3 4 I ^ ” 

letter No- 5 6 7 8 9 10 1 

WNo- 11 12 13 I ' 

- “ '' “ 18 19 201 

S al," - - - - - 

Letter No- 34 35 

TT _ , , Method (2) 

Keymg element No.. 1 _ 2 3 4 5 « 7 o „ 

Letter No..... 7-5- h~^ - - -2-1_ g 9 

-1 ii-}»ji - 1 ; ^ 

Letter No..... 21 I - - 

Letter No... 25 *>0 I ot n 

wNo..--;;;;;;;;:;a1,!!'z z a1 If ll'm 


9 I— 10 11 121 

13 14 15 16 17 18 


27 28 291 — 
33 34 35 etc 


18 19 20 
22 23 24 
— 30 31 


17- , METHOD (3) 

Keymg element No.. 1 2 3 4 

Letter No_ T 2 3 4 " 

Letter No_ _ _ 1 7 « 

Letter No._ __ _ o 

Letter No _ I5 J_ _ _ 

^tter No - 23 24 25 I — 

Letter No _ 27 26 _ _ 

Letter No. . 33 34 35 


8 9 10 11 12 13 14 

—119 18 17 16 

~ — — — 20 21 22 

~ — — — I 30 29 28 

®tc 31 32 
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e Suppose the correspondents agree that the mtemiption m the keymg sequence will take 
place after the occurrence of a specified letter called an interruptor,^ which may be a letter of the 
plain text, or one of the cipher text, as agreed upon in advance Then, smce m either case 
there is nothmg fixed about the tune the mterruption will occur—it will take place at no fixed 
mtervals—^not only does the interruption become quite irregular, foUowmg no pattern, but also 
the method never reverts to one havmg periodicity Methods of this type will now be discussed 
m detail 

19. Interruptor is a plain-text letter —o Suppose the correspondents agree that the inter¬ 
ruption m the key will take place immediately after a previously agreed-upon letter, say R, 
occurs m the plam text The key would then be mterrupted as shown m the followmg example 
(using the mnemomc key BUSINESS MACHINES and the HYDRAULIC XZ sequence) 


Key.- BUSINESSMACHIlBUSlBUSIBUSINEl 

Plam- AMMUNITIONFO R F I R S TARTILLER 

Cipher_ B 0 LYRPJDR 0 JKx|kJf|yXSXDJUPSy 1 

Key.- BUSINESSMACHINESBUBUSINES'SMACHlI 

Plain- YWILLBELOADEDAFTERAMMUNITIONFOR 

Cipher.- lYDPYFXURAFAENMJJVBOLYRPJDROJKxI 

Key.- B U S IIb U SlB U S I N ElB U S I N 

Plam- T H I R D A R T I L L E R Y 

Cipher.- D G D x|g U f|d J U P S y|i 


Cktptogbam 

B . 0 L Y R _ PJDRO JKX KJ FYXSX DJUPS YI YDP 

YFXUR AFAEN MJJV B OLYRP JDROJ KX D G D 
X G U F D J U P S Y I X X X X 

b Instead of employmg an ordmary plam-text letter as the mterruptor, one might reserve 
the letter J for this purpose (and use the letter I whenever this letter appears as part of a plam- 
text word) This is a qiute simple variation of the basic method The letter J acts merely 
as though it were a plam-text letter, except that m this case it also serves as the mterruptor 
The mterruptor is then mserted at random, at the whim of the enciphermg clerk Thus 


Key- BUSINESSMAC BUSINESSM BUSINESSMACHINESBUSIN 

Plam TROOPSWILLJ BEHALTEDJ ATROADIUNCTIONFIVESIX 


e It IS obvious that repetitions would be plentiful m cryptograms of this construction, 
regardless of whether a letter of high, medium, or low frequency is selected as the signal for key 
mterruption If a letter of high frequency is chosen, repetitions will occur qmte often, not 
only because that letter will certainly be a part of many common words, but also because it wiU 
be followed by words that are frequently repeated, and smce the key starts agam with each 
such interruption, these frequently repeated words will be enciphered by the same sequence of 
alphabets This is the case m the first of the two foregomg examples It is clear, for mstance, 
that every time the word ARTILLERY appears m the cryptogram the cipher equivalents of 
TILLERY must be the same If the mterruptor letter were Ap mstead of Rp, the repetition 

‘ Also called at tunes an “mfluence" letter because it influences or modifies normal procedure In some 
cases no influence or interruptor letter is used, the mterruption or break m the keying sequence occurrmg after 
a previously-agreed-upon number of letters has been enciphered 
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would include the cipher equivalents of RTILLERY, if it were Tp, ILLERY, and so on On the 
other hand, if a letter of low frequency were selected as the mterruptor letter, then the encipher- 
ment would tend to approximate that of normal repeating-key substitution, and repetitions 
would bo plentiful on that basis alone 

d Of courae, the lengths of the mtervals between the repetitions, m any of the foregoing 
cases, woidd be irregular, so that penodicity would not be manifested The student may 
inquire, therefore, how one would proceed to solve such messages, for it is obvious that an 
attempt to allocate the letters of a single message into separate monoalphabetic distnbutions 
canimt be successful unless the exact locations of the mterruptions are known—and they do 
not become known to the cryptanalyst until he has solved the message, or at least a part of it 
Thus It would appear as though the would-be solver is here confronted with a more or less insoluble 
dilemma This sort of reasoning, however, makes more of an appeal to the novice in cryptog- 
r^hy than to the experienced cryptanalyst, who specializes m methods of solvmg ciyptographic 

e (1) The problem here will be attacked upon the usual two hypotheses, and the easier 
one will be discussed first Suppose the system has been in use for some time, that an original 
solution has been reached by means to be discussed under the second hypothesis, and that the 
cipher alphabets are known There remams unknown only the specific key to messages Exam- 
mmg whatever repetitions are found, an attack is made on the basis of searchmg for a piobable 
word Thus, takmg the illustrative message m subparagraph a, suppose the presence of the 
word ARTILLERY is suspected Attempts are made to locate this word, hasmg the search 
upon the construction of an mtelhgible key Beginnmg with the veiy first letter of the message 
the word ARTILLERY is juxtaposed against the cipher text, and the key letters ascertained] 
using the known alphabets, whic h we will assume m this case are based upon the HYDRAULIC 
XZ sequence shdmg against the normal Thus 

Cipher - - BOLYRPJDR 

Plain- ARTILLERY 

“Key”- BHJQPIBFU 

(2) Since this “key” is certamly not mtelhgible text, the assumed word is moved one letter 
to the right and the test repeated, and so on until the followmg place in the test is reached 

Cipher_ . _ SXDJUPSYI 

Plam....-- ARTILLERY 

Key- SIBUSINEB 

(3) The sequence BUSINE suggests BUSINESS, moreover, it is noted that the key is m- 
teriupted both times by the letter Rp Now the key may be applied to the beginnmg of the 
message, to see if the whole key or only a portion of it has been recovered Thus 

Key. BUSINESSBUS 

Cipher. BOLYRPJDROJ 

Ham.— AMMUNITIUMT 

(4) It IS obvious that BUSINESS is only a pait of the key But the deciphered sequence 

^ AMMUNITION When this is tned, the key is extended to 

BUSINESS MA Enough has been shown to clarify the procedure 
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/ The foregomg solution is predicated upon the hypothesis that the cipher alphabets are 
known But what if this is not the c ase? What of the steps necessary to arrive at the first 
solution, before even the presence of an mterruptor is suspected? The answer to this question 
leads to the presentation of a method of attack which is one of the most important and powerful 
means the cryptanalyst has at his command for unraveling many knotty problems It is called 
8 olvi%on by myenmposihon, and warrants detailed treatment 

20. Solution by superimnosition — a Baste principles — (1) In solvmg an ordmary 
repeating-key cipher the first '•♦cp, that of ascertaming the length of the period, is of no signih- 
c ance m itself It merely paves the way for and makes possible the second step, w'hich consists 
m allocating the letters of the cryptogram into individual monoalphabetic distributions The 
third step then consists m solving these distributions Usually, the text of the message is trans¬ 
cribed mto its penous and is written out m ouccessive hues corresponding m length with that 
of the period The diagram then consists of a senes of columns of letters and the letters in each 
column belong to the same monoalphabet Anothei w ay of looking at the matter is to conceive 
of the text as havmg thus been tianscnbed mto superimposed periods m such case the letters m 
each column have undergone the same kind of ticatment by the same elements (plain and cipher 
components of the cipher alphabet) 

(2) Suppose, however, that the repetitive key is very long and that the message is short, so 
that there are only a very few cycles m the text Then tne solution of the message becomes 
difBcult, if not impossible, because theie is not a sufficient number of supenmposable periods to 
yield monoalphabetic distnbutions which can be solved by frequency prmciples But suppose 
also that there are many short cryptograms all enciphered by the same key Then it is clear 
that if these messages are superimposed 

(a) The letters m the respective columns will all belong to individual alphabets, and 

(b) If there is a sufiicient number of sm h superiirposable messages (say 25-30, for English), 
then the frequency distnbutions applicable to the suciessive columns of text can be solved— 
without knowing the length oj the key In other words, any difficulties that may have ansen on 
account of failure or mabdity to ascertain the length of the penod have been circumvented 
The second step m normal solution is thus “by-passed ” 

(3) Furthermore, and this is a veiy important pomt, m case an extremely long key is em¬ 
ployed and a senes of messages begmnmg at different mitial points are enciphered by such a key, 
this method of solution by supenmposition can be employed, provided the messages can be super¬ 
imposed correctly, that is, so that the letters wiuch fall m one column really belong to one cipher 
alphabet Just how this can be done will be demonstrated m subsequent paragraphs, but a 
clue has already been given m paragraph 18c At this point, however, a simple illustration of 
the method wuU be given, usmg the substitution system discussed m paragraph 19 

h Example —(1) A set of 35 messages has been mtercepted on the same day Presumably 
they are all m the same key, and the presence of repetitions between messages corroborates this 
assumption But the mtervals between repetitions withm the same message do not show any 
common factor and the messages appear to be aperiodic in nature The probable-word method 
has been apphed, usmg standard alphabets, with no success The messages are then super¬ 
imposed (Fig 6), the frequency distnbutions for the first 10 columns are as shown m Figure 6 


a 
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1 ZCTPZWZPEPZQX 

2 WTEQMXZSYSPRC 

3 TCRWCXTBHH 

4 EFKCSZRIHA 

5 YANCIHZNUW 

6 VZIETIRRGX 

7 HCQICKGUON 

8 ZCFCLXRKQW 

9 HWWPTEWCIMJS 

10 EPDOZCLIKSJ 

11 WTSSQZPZIET 

12 ZCGGYFCSBG 

13 CWZAOOEMHWTP 

14 CIYGIFBDTVX 

15 EAQDRDNSRCAPDT 

16 YFWCQQBZCWC 

17 WTEZQSKUHC 

18 ZCVXQZKZYDWLK 


19 AFEOJTDTIT 

20 KPVFQWPKTEV 

21 ZABGRTXPUQX 

22 YHEOCUHMDT 

23 CLCPZIKOTH 

24 AFLWWZQMDT 

25 ZCWAPMBSAWL 

26 HFLMHRZNAPECE 

27 CLZGEMKZTO 

28 TPYFKOTIZUH 

29 ZCCPSNEOPHDYL 

30 CIYGIFTSYTLE 

31 YTSVWVDGHPGUZ 

32 NOCAIFBJBLGHY 

33 ZXXFLFEGJL 

34 ZCTMMBZJOO 

35 HCQIWSYSBPHCZV 


Fiqcbe 6 

5J. g -5 ^ ^ § 

I ABCDEFGHIJKLMNOPQRSTUVWXYZ 

i 

55 

2 . ABCDEFGHIJKLMNOPQRSTUVWXYZ 

3. ABCDEFGHIJKLMNOPQRSTUVWXYZ 
1 ABCDEFGHIJKLMNOPQRSTUVWXYZ 

5. ABCDEFGHIJKLMNOPQRSTUVWXYZ 

- g ^ 55 ^^ 5 

6 . ABCDEFGHIJKLMNOPQRSTUVWXYZ 

7. ABCDEFGHIJKLMNOPQRSTUVWXYZ 

8 . ABCDEFGHIJKLMNOPQRSTUVWXYZ 

§•>. as 

9. ABCDEFGHIJKLMNOPQRSTUVWXYZ 
10 ABCDEFGHIJKLMNOPQRSTUVWXYZ 


Figubx g 


(2) The let and 2d distnbutions are certainly monoalphabetic There are very marked 
crests and troughs, and the number of blanks (14) is more than satisfactory m both cases (Let 
the student at this pomt refer to Par 14 and Chart 5 of Mihtary Cryptanalysis, Part I) But 
the 3d, 4th, and remaining distnbutions appear no longer to be monoalphabetic Note particu¬ 
larly the distnbution for the 6th column From this fact the conclusion is drawn that some 
disturbance m penodicity has been mtroduced m the cryptograms In other words, although 
they all start out with the same alphabet, some sort of mterruption takes place so as to suppress 
penodicity 

(3) However, a start on solution may be made by attackmg the first two distnbutions, 
frequency studies bemg aided by consideratiors based upon probable words In this case, smce 
the text compnses only the begm mn gs of messages, assumptions for probable words are more 
easily made than when words are sought m the mtenors of messages Such common mtro- 
ductory words as REQUEST, REFER, ENEMY, WHAT, WHEN, IN, SEND, etc, are good ones 
to assume Furthermore, high-frequency digraphs used as the mitial digraphs of common 
words will, of course, mamfest themselves m the first two columns The greatest aid m thia 
process is, as usual, a famihanty with the “word habits” of the enemy 

(4) Let the student try to solve the messages In so domg he will more or less qmckly finJ 
the cause of the rapid fallmg off m monoalphabeticity as the columns progress to the ri g ht from 
the mitial pomt of the messages 

21 Interraptor is a cipher-text letter —a In the precedmg case a plain-text letter serves 
as the mterruptor But now suppose the correspondents agree that the mterruption m the key 
will take place immediately after a previously-agreed-upon letter, say Q, occurs m the cipher 
text The key would then be mterrupted as shown in the foUowmg example 


Key. - BUSINESSMACHINESBUSINESSM 

Flam _ AMMUNITIONFORFIRSTARTILLE 

Cipher. - BOLYRPJDROJKXTPFYXSXBPUUQ 

Key. - BUSINESSMACHINlBUSINESSMACHBU 

Flam - RYWILLBELOADEDAFTERAMMUNITIO 

Cipher - HRNMYTTXHPCRFqIbEJFIELLBONQO’Q 

Key- BUSINESSMACHBUSINE 

Flam _ NFORTHIRDARTILLERY 

Cipher - VECXBODFPAZQONUFIC 


Cryptogram 

B_0LYR PJDRO JKXTP FYXSX BPUUQ HRNMY 

TTXHP CRFQB EJFIE LLBON QjQQVE C X B 0 D 

FPAZS ONUFI CXXXX 

b In the foregoing example, there are no sigmficant repetitions Such as do occur comprise 
only digraphs, one of which is purely accidental But the absence of significant, long repetitions 
18 itself purely accidental, for had the mterruptor letter been a letter other than Qo, then the 
phrase AMMUNITION FOR, which occurs twice, might have been enciphered identically both 
















tunes If a short key is employed, repetitions may be plentiful For example, note the fol¬ 
lowing, in which So IS the mterruptor letter 


Key__ BANDSBANDSBANDSBANDSBANBANDSBANDSB 

Plain ... FROMFOURFIVETOFOURFIFTEENAMBARRAGE 

Cipher..... K T A K Z W X I I D A C B N Z W X I I D KWS JONKTBTIDHJ 


c This last example gives a clue to one method of attacking this type of system There 
will be repetitions within shoit secticns, and tbe mterval between tbem will sometimes permit 
of asceji taming the leiigtli of the kev In su( h slu it settions, the lettois which mtervene between 
the repeated sequences may be eliminated as possible mterruptor letters Thus, the letters 
A, C, B, and N may be ehminated, in the foregoing example, as mterruptor letters By extension 
of tlus prmciple to the letters mtervenmg between other repetitions, one may more or less 
quickly ascertain what letter serves as the mterruptor 

d Oni.e the mteiiuptor lettei has been found, the next step is to break up the message 
mto “dnmterrupted” sequences and then attempt a solution by superimposition The pnn- 
ciples explained m paiagraph 20 need only be modified in mmoi respects In the first place, m 
tlus case the columns of text formed by the supeiimposition of umnterrupted sequences wifi 
be puiely nonoalpuabetic, whereas in the case of the example m paiagraph 20, only the very 
first column is puiely monoalphabetic, the monoalphabeticity faUmg off very lapidly with the 
2d, 3d, columns Hence, m this case the analysis of the mdmdual alphabets shoidd be 
an easier task But this would be counterbalanced by the fact that whereas m the former case 
the cryptanalyst is dealing with the imtial words of messages, in this case he is dealmg with 
interior poi tions of the text and has no w ay of loiow mg where a word begins The latter remarks 
naturally <io not apply to the case wheie a whole set of messages m this system, all in the same 
key, can be subjected to sunultareous study In such a case the cryptanalyst would also have 
the mitial words to work upon 

22 Concluding remaiks —a The preceding two paragiaphs both deal witli the first anc’ 
simplest of tbe three basic c ases referred to under paragraph 18 The second of those cases 
involves coiisideiably more work m solution for the leason that when the mterruption takes 
place and the keying sequence recommences, the latter is not mvanably the mitial pomt of the 
sequence, as m the first case 

h In the second of those cases the mterruptor causes a break m the keying sequence and 
a recommencement at any one of the 10 keying elements Consequently, it is impossible now 
merely to superimpose sections of the text by shifting them so that their imtial letters fall m 
the same column But a superimposition is nevertheless possible, provided the interruptions 
do not occur so frequently * that sections of only a very few letters are enciphered by sequent 
keyletters In order to accomphsh a proper superimposition in this case, a statistical test 
IS essential, and for this a good many letters are required The nature of this test will be 
explained in Section XI 

c The same thing is true of the last of the three cases mentioned under paragraph 18 
The solution of a case of this sort is admittedly a rather difficult matter which will be taken up 
m its proper place later 

d (1) In the cases thus far studied, either the plam-text groupmgs were vanable m length 
and were enciphered by a constant-length key, or the plam-text groupmgs were constant m 

“ When no mterruptor or “influence letter” is used, the interruption or break in the keying sequence occurs 
after the encipherment of a deflnite number of letters Once this number has been ascertained, solution of 
subsequent messages is very simple 
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length and were enciphered by a vanable-length key It is possible, however to combme both 
prmciples and to apply a vanable-length key to vanable-length groupmgs of the plam text 

(2) Suppose the correspondents agree to encipher a message accordmg to word lengths, but 
at irregular mtervaJs, to add at the end of a word an mteiiuptor letter which wdl serve to inter¬ 
rupt the key Note the following, m wluch the key is BUSINESS MACHINES and the mterruptor 
letter is X 

S'l.VV: ABMUNITIOM FOR FIR^STX 

Qpher . BTTRVODOWV EQV ZDFGJO BHDOSSJHI 

CRYPrOGBAM 

BTTRV ODOffV EQVZD FGJOB HDOSS JHI etc 

(31 The foregomg system is only a mmor modification of tne simple case of ordmary word 
length encipherment as explamed m Section II If standard cipher alphabets are used, he 
s^modic mterruption and the presence of the mterruptor letter would cause no difficulty 
vSiatever, smee the solution can be achieved mechamcaUy, by completmg the plam-component 
sequence If mixed cipher alphabets are used, and the piim^ components ^e untoown, 
sXtion may be reached by following the proceduie outlined m Sections II and III, with such 
modifications as are suitable to the case 

e It IS hardly necessary to pomt out that the foregomg types of apenodic substitution are 
rather unsmtable for practical mUitary usage Enupheiment is slow and subject to ewor In 
some cases encipherment can be accomplished only by smgle-letter opeiation For if the 
mterruptor is a cipher letter the key is mterrupted by a letter which cannot be Imown m advance, 
if the mterruptor is a plam-text letter, while the mterruptions can be mdicated before encipher¬ 
ment 18 begun, the iriegulanties occasioned by the mterruptions m keying cause confusion and 
quite materially retard the enciphermg process In deciphermg, the rate of speed would be 
mst as slow m wther method It is obvious that one of the pnncipal disadvantages m aU these 
methods is that if an error m transmission is made, if some letters are onutted, or if anythmg 
happens to the mterruptor letter, the message becomes difficult or impossible to 
by the ordmary code clerk Finally, the degree of cryptographic security attainable by most 
of these methods is not sufficient for military purposes 






















Section VI 


REVIEW OF AUTO-KEY SYSTEMS 

Pangaph 

The two basic methods of auto-kej encipherment_ 23 

23 The two basic methods of auto-key encipherment —a In auto-key encipherment there 
are two possible sources for successive key letters the plam text or the cipher text of the message 
itself In either case, the xniiwl key letter or key letters are supplied by preagreement between 
the correspondents, after that the text letters that are to serve as the key are displaced 1, 2, 3, 
mtervals to the nght, depending upon the length of the prearranged key 

h (1) An example of plam-text keymg wdl first be shown, to refresh the student’s recollec¬ 
tion Let the previously agreed upon key consist of a smgle letter, say X, and let the cipher 
alphabets be direct standard alphabets 

Key. XNOTIFYQUARTERMASTER 

Plam. NOTIFYQUARTERMASTER 

Cipher.. KBHBNDOKURKXVDMSLXV 

(2) Instead of havmg a single letter serve as the mitial key, a word or even a long phrase 
may be used Thus (usmg TYPEWRITER as the imtial key) 

typewriter! NOTIFYQUAR 
NOTIFYQUARTERMASTER 
GMIMBPYNEIGSKUFQJYR 

c (1) In cipher text auto keymg the procedure is quite similar If a single imtial key letter 
is used 


Key—__ XjKYRZECSMMDWARDDVOS 

Plam. NOTIFYQUARTERMASTER 

Cipher-_ KYRZECSMMDWARDDVOSJ 


(2) If a key word is used 

typewriter ! GMIMBPYNEI 
NOTIFYQUARTERMASTER 
GMIMBPYNEIZQZYBHRRV 

(3) Sometimes only the last cipher letter resultmg from the use of the prearranged key 
word IS used as the key letter for enciphenng the auto-keyed portion of the text Thus, m the 
last example, the plam text begmmng TERMASTER would be enciphered as follows 

Key.— 

Plam... 

Cipher. 


Key..... 

Plam_ 

Cipher. 


Key- 

Plam. 

Cipher.- 


TYPEWRITER! IBFWIIATX 
NOTIFYQUARTERMASTER 
GMIMBPYNEIBFWIIATXO 
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d In the foregomg examples, direct standard alphabets are employed, but mixed alphabets, 
either mteirelated or mdependent, may be used ]ust as readily Also, instead of the ordinary 
type of cipher alphabets, one may employ a mathematical process of addition (see p^ 40/ of 
Special Text No 166, Advanced Military Cryptography) but the difference between the latter 
process and the ordmary one usmg shdmg alphabets is more apparent than real 

e Smce the analysis of the case m which the cipher text constitutes the auto W m usually 
easier than that m which the plam text serves this function, the former will be the first to be 
discussed 
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Section VII 

SOLUTION OF CIPHEB-TEXT AUTO-KEY SYSTEMS 

^lution of cipher-text auto-keyed cryptograms when known alphabets are employed 

Example of solution by frequency analysis_ 

Example of solution by analysis of isomorphisms. 

Bpecial case of solution of cipher-text auto-keyed nr'ypVnff rr,^'o ~ 

« flf auto-keyed cryptograms when known alphabets are employed - 

1 * ^ I® ^ cryptanalyst knows the cipher alphabets which 

re mployed in encipherment, the solution presents hardly any problem at all It is only 
message beyond the key letter or key-word portion and the initial part 
of the plam text enciphered by this key letter or key word can be filled m from the context 
An example, usmg standard cipher alphabets, follows herewith 

Cryptogbam 

WSGQV OHVMQ WEQUH AALNB NZZMP ESKD 
Wnting Ae cipher text as key letters (displaced one mterval to the right) and deciphering 

by direct standard alphabets yields the foUowmg 


. ^^SGQVOHVMQWEQUHAALNBNZZMPESK 

Qpher. - WSGQVOHVMQWEQUHAALNBNZZMPESKD 

. '^°*^pttoregimentalcommandpost 


report as the imtial word of the message yields an mtelhgible word 
as the initial key FORCE, so that the message reads 


Key.. FORCEVOHVMQ 

Cipher... WSGQVOHVMQ . . 

Plam- REPORTTORE. . . 


(4) A semiautomatic method of solvmg such a message is to use shdmg normal alphabets 
S Sr r progresses from left to ngbt, each cipher letter is set opposite 

tte lettOT A on the preceding stnp Takmg the letters VMQWEQUHA m the foregomg example, 
note m Rgure 7 the senes of placements of the successive stnps Then note how the succesave 
MqSIeq^^ regiment reappear to the left of the successive cipher letters 

( 30 ) 
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A 

V H 

X T 

X N H 0 

B 

W I 

Y U 
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0 

I P 
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X J 

Z V 

Z P 

J Q 
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Y K 

A W 

A Q 

K R 

E 

Z L 

B X 
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L S 
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J F 
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T^ 

N 

I U 

K G 

K 

A 
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P 
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M I 
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C 

W D 
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L X 
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N 
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0 K 
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E 
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S N Z 

P L 
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Z E 
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0 A 
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A H 

U P B 

R N R 

H 

B I 

V Q C 

S 0 

S 
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C J 

ff R D 

T P 

T 
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D K 

X S E 

U Q U 
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E L 

Y T F 

V R V 

L 

F M 

Z U G_W S W 

M 
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6 If, as a result of the analyas of several messages (as descnbed m par 25), mixed 
primary components have been reconstructed, the solution of subsequent messages may readily 
be accomplished by following the procedure outhned m a above, smce m that case the cipher 
alphabets have become known alphabets 

25. General prmciples underlying solution of cipher-text auto-keyed cryptograms by 
frequency analysis —o First of all, it is to be noted in connection with cipher-text auto-keymg 
that repetitions will not be nearly as plentiful m the cipher text as they are m the plam text, 
because m this system before a repetition can appear two thmgs must happen simultaneously 
First, of course, the plam-text sequence must be repeated, and second, one or more cipher-text 
letters (depending upon tho length of the mtroductory key) immediately before the second appear¬ 
ance of the plain-text repetition must be identical with one or more cipher-text letters immediately 
before the first appearance of the group This can happen only as the result of chance In 
the following example the mtroductory key is a single letter, X, and direct standard components 
are used m the usual Vigenfire manner 

Key._ XCKBTMDHNVHLY KDKSJMDHNVHLY 

Plain._ FIRSTREGIMENT THIRDREGIMENT 

Cipher._ C K B T MDHNVHLYR K D K S J MDHNVHLYR 






















32 


The repeated plain-text word, REGIMENT, has only 8 letters but the repeated cipher-text group 
contains 9, of which only the last 8 letters actually represent the plain-text repetition In 
order that the word REGIMENT be enciphered byDHNVHLYR the second time this 
word appeared in the text it was necessary that the key letter for its first letter, R, be M both 
times, no other key letter will produce the same cipher sequence for the word REGIMENT in this 
case Each different key letter for enciphering the first letter of REGIMENT will produce a 
different encipherment for the word, so that the chances ‘ for a repetition in this case are roughly 
about 1 in 26 This is the principal cause for the reduction in repetitions m this system If 
an mtroductory key of two letteis were used, it would be necessary that the two cipher letters 
immediately before the second appearance of the repeated word REGIMENT be identical with 
the two cipher letters immediately before the first appearance of the word In general, then, 
an n-letter repetition m the cipher text, m this case, represents an (n—jt)-letter repetition m the 
plam text, where n is the length of the cipher-text repetition and k is the length of the introductory 
key 

h There is a second phenomenon of mterest m connection with the cipher-text auto-key 
method Let the letter opposite wluch the key letter is placed (when usmg sliding components 
for encipherment) be termed, for convenience m reference, "the base letter ” Normally the 
base letter is the mitial letter of the plam component, but it has been seen in preceding texts 
that tins IS only a convention Now when the mtroductory key is a smgle letter, if the base 
letter occurs as a plain-text letter its cipher eqmvalent is identical with the immediately pre- 
cedmg cipher letter, that is, there is produced a double letter in the cipher text, no matter what 
the cipher component is and no matter what the key letter happens to be for that encipherment 
For example, using the HYDRAULIC XZ sequence for both primary com¬ 

ponents, with H, the initial letter of the plain component as the base letter, and usmg the 
introductory key letter X, the followmg encipherment is produced 

Key. XJOIIFLYUTTDKKYCXG 

Plain. MANHATTANHIGHJINKS 

Cipher.... JOIIFLYUTTDKKYCXGL 

Note the doublets II, TT, KK Each time such a doublet occurs it means that the second letter 
represents Hp, which is the base letter m this case (initial letter of plain component) Now if 
the base letter happens to be a high-frequency letter in normal plam text, for example the letter 
E, or T, then the cipher text will show a large number of doublets, if it happens to be a low-fre¬ 
quency letter the cipher text will show very few doublets In fact, the number of doublets 
will be directly proportional to the frequency of the base letter m normal plam text Thus, 
if the cryptogram contains 1,000 letters there should be about 72 occurrences of doublets if 
the base letter is A, since in 1,000 letters of plam text there should be about 72 A’s Conversely, 
if a cryptogram of 1,000 letters shows about 72 doublets, the base letter is hkely to be A, if it 
shows about 90, it is likely to be T, and so on Furthermore when a clue to the identity of the 
base letter has been obtained m this manner, it is possible immediately to msert the correspondmg 
plam-text letter throughout the text of the message The distribution of this letter may not 
only serve as a check (if no mconsistencies develop) but also may lead to the assumption of 
values for other cipher letters 

c When the introductoiy key is 2 letters, then this same phenomenon wiU produce groups 
of the formula ABA, where A and B may be any letters, but the first and third must be identical 
The occurrence of patterns of this type in tins case mdicates the encipherment of the base letter 

^ If all the cipher letters appeared with equal frequency the chances would be exactly 1 in 26 But certain 
letters appear with greater frequency because some plain-text letters are much more frequent than others 
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d The phenomena noted above can be used to considerable advantage in the solution of 
cryptograms of this type For mstance, if it is known that the ordinary Vigen^re method of 
encipherment is used %ix=Q^n), then the mitial letter of the plain component is 

the base letter If, further, it is known that the plain component is the normal direct sequence, 
then the base letter is A and a word such as BATTALION will be enciphered by a group havmg 
the formula AABCCDEFG If the plam component is a mixed sequence and happens to start 
with the letter E, then a word such as ENEMY would be enciphered by a sequence havmg the 
formula AABB CD ® Sequences such as these are, of course, idiomorphic and if words yieldmg 
such idiomorphisms are frequent m the text there will be produced in the latter several or many 
cases of isomorplusm When these are analyzed by the principles of indirect symmetry of 
position, a qmck solution may follow 

c A final principle underlymg the solution of cipher-text auto-keyed cryptograms remams 
to be discussed It concerns the nature of the frequency distributions required for the analysis 
of such cryptograms This principle will be set forth in the next paragraph 

26 Frequency distributions required for solution— a Consider the message gwen in 
paragraph 23c (1) It happens that the letter R. occurs twice m this short message a,nd, because 
of the nature of the cipher-text auto-keymg method, this letter must also appear twice m t 
key Now it is obvious that all plam-text letters enciphered by key letter Rx will be m the same 
cipher alphabet, m other words, if the key text is "offset” one letter to the right of the cipher 
text, then every cipher letter whch xmmedmtely follows an R„ m the cryptogram vxMhelorig to the 
same cipher alphabet, and this alphabet may be designated conveniently as the R cipher alphabet 
Now if there were sufficient text, so that there were, say, 30 to 40 Rc s m it, then a frequency 
distribution of the letters immediately followmg the R.’s wffi exffibit 
Wliat has been said of the letters following the Re’s applies equally well to 
all the other letters of the cipher text, the A,’s, Be’s, Ce's, and so on In short, if distributions 
are made, one for each letter of the alphabet, showing the cipher letter imniediately succeeding 
each different letter of the cipher text, then the text of the cryptogram can be allocated m o 26 
unihteral, monoalphabetic frequency distnbutions which can be solved by frequency analysis, 
providmg there are sufficient data for this purpose v 

b The foregomg prmciple has been described as pertaining to the case when the mtroducto^ 
key IS a smgle letter, that is. when the key text is “offset” or displaced ^ut ®ne interval to the 
right of the cipher text But it applies equally to cases wherem the key text is offset more t 
one mterval, provided the frequency distributions are based upon the proper interval, as deter¬ 
mined by the displacement due to the length of the mtroductory key For mstance, suppose 
the mtroductory key consists of two letters, as m the following example 

Key text .XZIMRHFHGFNQRXOMRMVWEE 

Plam text".:..:_ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ° H t ll ' 

Cipher text _ MRHFHGFNQRXOMRMVWEE 

The key text m this case is offset two mtervals to the right of the cipher text and therefore, fre¬ 
quency distributions made by taking the cipher letters one mterval to the right of a 
letter, each time that letter occurs, will not be monoalphabetic because some letter 
at aU to the given cipher letter is the key letter for enciphenng the letter ^ 

nght of the latter For example, note the three R„’s in the foregoing dl'^^tratmn The first 
R„ IS followed by H„ representing the encipherment of Lp by M.,, the second ^ ® ^ J 

representing the encipherment of F„ by Q., the third R„ is followed by M representing the en 
cipherment of Ap by M, The three cipher letters H, X, and M are here entirely unrelated and do 

^Six letters are shown because the idiomorphism m this case extends over that many letters 
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not belong to the same cipher alphabet because they represent encipherments by three different 
key letters On the other hand, the cipher letters two intervals to the right of the Re’s, viz, 
F, 0, and V, are m the same cipher alphabet because these cipher letters are the results of en¬ 
ciphering plain-text letters I, 0, and T, respectively, by the same key letter, R It is obvious, 
then, that when the introductory key consists of two letters and the key text is displaced two 
intervals to the right of the cipher text, the proper frequency distributions for monoalphabeticity 
will be based upon the letter at the second interval to the right of each cipher letter Likewise, 
if the mtroductory key consists of three letters and the key text is displaced three mtervals to 
the nght of the cipher text, the distributions must be based upon the third interval, and so on 
in each case the interval used corresponding to the amount of displacement between key text 
and cipher text 

c Conversely, in solving a problem of this type, when the length of the mtroductory key 
and therefore the amount of displacement are not known, the appearance of the frequency dis- 
tnbutions based upon vanous intervals after each different cipher letter will disclose this un¬ 
known factor, smce only one set of distnbutions will exhibit monoalphabeticity and the mterval 
corresponding to that set will be the correct interval 

d Apphcation of these principles will now be made, using a specific example 
27. Example of solution by frequency analysis —a It will be assumed that previous studies 
have disclosed that the enemy is using the cipher-text auto-key system described It will be 
further assumed that these studies have also disclosed that (1) the introductory key is usually a 
single letter, (2) the usual VigenSre method of employmg slidmg primary components is used, 
(3) the plain component is usually the normal direct sequence, the cipher component a mixed 
sequence which changes daily. The followmg cryptograms, all of the same date, have been 
mtercepted 

Message I 


I J X W X 

Q Z S X D 

E H H L M 

C A R P H 

T D I Q K 

0 K N T B 

E E C D A 
H I F E L 
R V C U R 
M G L D Y 
K M L T U 
T Z J 0 Q 

C N Q E T 

N N J J I 

G D I E Q 

F Y T C D 

R Q G G N 

Y S C D I 

U K N M V 

D I V E Y 

S G T A R 

G Y F K R 

K M K I X 

D G E T X 

D I W P P 
G T C Z M 
J J Q Q Y 
F K S E T 
J X W K A 
G X X X X 



Message 11 



G R V R M 

R T N J U 

F H I J A 

F F N F I 

A 0 0 X D 

Z W K X G 

A K 0 B L 

Q B M L T 

B W N Y S 

B U Y N K 

W P C K K 

N L M W K 
PURRS 

T C E T P 

L B W C D 

R M X A N 

Y Y Z J U 

U E Q E V 

D G T T Z 

G G K X X 

J C C X U 
C S U H F 
Z E Y G C 
R R Q H Q 



Message III 



R W K A 0 

M W T Q 0 

L A Q Y U 

L T C J M 

H Q V G X 

K I R 0 Z 

Z D K V U 

C H 0 L M 

T Q Y U X 

J C D D Y 

W V G R K 

B Z E L M 

I B R X D 
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X J J P M 
T U T C V 
S U M U J 


G I S U H 
X C T B S 
H A G I E 
P S F A J 
W P V I B 
M U Z E L 
F 0 R S A 


T B J P A 
B D A Q Y 
C E C Z M 


T B J P A 
S F T Q T 
X U K T X 
F X X X X 


L T Z K X 
G R J P F 
C S L G X 


W Z H S T 
F K I R H 
W M E H H 
U Q Z H Z 
0 B C C X 
Y 0 0 V U 
J L N Q M 


A R Y Y P 
M M T T F 
M W 0 H C 


Q A A Z T 
C J J G J 
G Q B 0 X 


Message IV 

E C A Q Z 
F D I P P 
H X M 0 Z 

Message V 

T Z 0 I D 
M M V Y M 
L M W K Y 
M T F H Z 
N N D G I 
J W K I E 
B Q X X X 

Message VI 

V H I D I 
U U N M G 
F 0 B H V 

Message VII 

R X A L X 
0 V M R G 
M X D I D 


N T T 0 C 
D I X C E 
E K A Q I 


D H 0 0 V 
I I V U U 
P P D Q Z 
M L A C Z 
E S J 0 C 
I B B 0 Z 


T U X N J 
Q P U X M 
N K A Z C 


F K K M E 
L V W T T 
S P B S F 


0 N D U C 
S E T W W 
S U A 0 X 


N B T J G 
C Z M J E 
G B 0 I W 
R 0 V D I 
K B J H Q 
A J I E F 


M X G S S 
0 V U Y E 
K M X X X 


I A A B D 
J U A W L 
L Y Z K C 


6 A dist^bution table of the type described m paragraph 25e is compiled and is shown as 
Figure 8 below In makmg these distributions it is simple to msert a tally m the appropriate 
cell m the pertment horizontal Ime of the table, to mdicate the cipher letter which immediately 
follows each occurrence of the letter to which that Ime applies Obviously, the best method of 
compilmg the data is to handle the text digraphically, takmg the first and second letters, the 
second and third, the third and fourth, and so on, and distributing the final letters of the digraphs 
m a quadncular table The distnbution merely takes the form of tally marks, the fifth bemg a 
diagonal stroke so as to totahze the occurrences visibly 
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SECOND LETTER 


ABCDEFGH I JKLMNO PQRSTUVWXYZ 





c The individual frequency distributions give every appearance of being monoalphabetic 
w^ch checks the assumption that the enemy is still employing the same system The total 
number of letters of text (excluding the final X’s) is 680 If the base letter is A then there should 
be approximately 680X7 2%=49 cases of double letters in the text There are actually 52 
such cases, w^ch checks quite well with expectancy The letter A is substituted throughout 
the text for the second letter of each doublet 
d The following sequence is noted 

Message V, line 1. GISUH WZHS Z 0 I D~D HO^V NBTJG 

A A A 

Assume that the sequence DDHOOVNBT represents BATTALION Then the frequency of H. in the 

Lnuenev^ 0 ^ ^ occurrences Likewise, the 

« n ^1 1°K ? i!'*’ should be high, it is also only 2 The frequency of V 

the 0 alphabet should be medium or low, since it would equal Lp, it is 5, which is too high 
the letters of the assumed word are similarly checked against the appropriate fre- 
q y is nbu ions, with the result that, on the whole, the assumption that the DDHOOVNBT 
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sequence represents BATTALION does not appear to be warranted Similar attempts are made 
at other pomts m the text, with the same or other probable words Some of these attempts 
may haye to be earned to the point where the placement of \ alues m the tentative cipher com¬ 
ponent leads to serious mconsistencies Finally, attention is fixed upon the following sequence 

Message VI, line 2 .... . B D A Q Y Wu FI' F iTu N M G 

A A A 

The word *^VAILA^E assumed The appropnate frequency distiibutions are consulted 
to see how well the actual individual frequencies correspond to the expected ones 


Alpha 

hot 

Assumed 

Frequency 

mation 

e. 

e„ 

Expected 

Actual 

M 

T 

V 

Low 

2 

Fair 

T 

F 

I 

High 

2 

Fair 

F 

U 

L 

Medium 


Good 

U 

N 

B 

Low 

1 

Good 

N 

M 

L 

Medium 

2 

Fair 

M 

G 

E 

High 

3 

Fair 


The assumption cannot be discarded just yet Let the values denvable from the assumption 
be mserted m their proper places m a cipher component, and, using the latter m conjunction 
with a normal direct sequence as the plain component, let an attempt be made to find corrobora¬ 
tion for these values The followmg placements may be made 

Plain _ ABCDEFGHIJKLMNOPQRSTUVWXYZ 

Cipher-..—. M F G UN T 

The letter appears twice in the cipher sequence and when this partially reconstructed cipher 
component is tested it is found that the value Lp(Nk)=Mo is corroborated Having tbe letters 
M, F, G, U, N, and T tentatively placed in the cipher component, it is possible to insert certain 
plain-text values m the text For example, in the M alphabet, Fc—Dp, Gc=Ep, U„=0p, Nc=Pp, 
Tc=Vp In the F alphabet, Gc=Bp, Uc=Lp, Np=Mp, Tp=Sp, Mc=Xp The other letters yield 
additional values m the appropriate alphabets 'The plain-text values thus obtainable are 
inserted in the cipher text No mconsistencies appear and, moreover, certain “good” digraphs 
are brought to light For instance, note what happens here 

Key. UQZH ZMTFH ZMLAC Z 

Message V, hne 4. Cipher. UQZHZ MTFHZ MLACZ . 

Plam. V I 

Now if the letter H can be placed m the cipher component, several values might be added to this 
partial decipherment Noting that F and G are sequent in the cipher component, suppose H 
follows G therein Then the following is obtained 

Key. UQZH ZMTFH ZMLAC Z 

Cipher. UQZHZ MTFHZ MLACZ 

Plain_ VIC 


Message V, line 4 
























Suppose the VIC is the beginning of VICINITY This assumption permits the placement of 
A, C, L, and Z m the cipher component, as follows 

Plain_ ABCDEFGHIJKLMNOPQRSTUVWXYZ 

Cipher_ MAFGH L ZUN T C 

These additional values check in very mcely and presently the entire cipher component is 
reconstructed It is found to be as follows 

Ham_ ABCDEFGHIJKLMNOPQRSTUVWXYZ 

Cipher_ MABFGHJKLQSVXZUNDERWOTYPIC 

The key phrase is obviously UNDERWOOD TYPEWRITER COMPANY All the messages now may 
be deciphered with ease The following gives the letter-for-letter decipherment of the first 
three groups of each message 

I (Introductory key K) 


Key.. I^IJXW XEECD ACNCQ 

Cipher _ TJXWX EECDA CNQET 

Plain _ RIGHT FAIRL YQUIE 

II (Introductory key E) 

Key. ElGRVR MZWKX GWPCK 

Cipher - GRVRM ZWKXG WPCKK 

Plam _ NOTHI NGOFS PECIA 

III (Introductory key R) 

Key- BlRWKA OLTCJ MZDKV 

Cipher. - RWKAO LTCJM ZDKVU 

Plam . ABOUT ONEHU NDRED 

IV (Introductory key J) 

Key_ J|XJJP MLTZK XECAQ 

Cipher. _ XJJPM LTZKX ECAQZ 

Plam .. GUARD INSUF FICIE 

V (Introductory key E) 

Key. _ ElGISU HWZHS TTZOI 

Cipher. _ GISUH WZHST TZOID 

Plam - NUMER OUSFL ASHES 

VI (Introductory key B) 

Key. B|TBJP AARYY PVHID 

Cipher. _ TBJPA ARYYP VHIDI 

Plam.... . THERE AREAB OUTSI 

VII (Introductory key B) 

Key. - ilTBJP AQAAZ TRXAL 

Cipher. - TBJPA QAAZT RXALX 

Plam _ THERE ISAMI XUPHE 
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e In the foregomg example the plam component was the normal direct sequence, so that 
with the Vigenfere method of encipherment the base letter is A If the plam component is a 
mixed sequence, the base letter may no longer be A, but m accordance with the prmciple set 
forth in paragraph 25b, the frequency of doublets m the cipher text will correspond with the 
frequency of the base letter as a letter of normal plam text If a good clue as to the identity 
of this letter is afforded by the frequency of doublets m the cipher text, the msertion of the 
correspondmg base letter m the plam text will lead to further clues The solution from there 
on can be handled along the hues mdicated above 

27 Example of solution by analysis of isomorphisms —a It was stated m paragraph 25d 
that m cipher-text auto-keymg the production of isomorphs is a frequent phenomenon and 
that analysis of these isomorphs may yield a qiuck solution An example of this sort will now 
be studied 

b Suppose the following cryptograms have been mtercepted 


1 


U S Y P W 
B E K V B 
P M Y U C 
T C V N I 
E F A A G 
A T N N B 
N X Q W H 
T N K K U 


T R X D I 
M A M M 0 
N E V V J 
X D D Q Q 
Z R L F D 
0 U P I T 
U V E V Y 
X L 0 D L 


M L E X R 
T X X B W 
L K Z E K 
E K K L R 
N D S C D 
J L X T C 
P L Q G W 
W T H C Z 


K V D B D 
E N A X M 
U R C N I 

V R F R F 
M P B B V 

V A 0 V E 
U P V K U 
R 


D Q G S U 
Q L Z I X 
F Q F N N 
X R 0 C S 
D E W R R 
Y J J L K 
B M M L B 


N S F B 0 
D I X G Z 
Y G S I J 
S J T B V 
N Q I C H 
D M L E G 
0 A E 0 T 


2 


B I I B F 
X R S C T 
K T T C F 
J 0 E Y M 


G R X L G 
K V B W K 
K V K R 0 
R P E E W 


H 0 U Z 0 
0 T G U Q 
B 0 E P L 
H 0 T J 0 


L L Z N A 
Q F J 0 C 
Q I G N R 
C R I I X 


M H C T Y 
Y Y B V K 
I Q 0 V J 
0 Z E T Z 


S C A A T 
I X D M T 
Y K I P H 
N K 


H A L 0 Z JR 
K Z E K U R F 
X A G X D M C 
B J N N B IT 


RVM MHCVB 
RFX YBHAL 
UNX XLXGZ 
MLJ OOSEA 


YUHAO EOV 
ZOFHM RSJ 
JPWUI FDB 
A T K P B Y 


AC Q V V J L 
Y L A P G R S 
BY P V F Z N 


e Frequency distnbutions are made, based upon the 2d letters of pairs, as m the preceding 
ATnmplA The result is shown m the table m figure 9 The data m each distribution are rela¬ 
tively scanty and it would appear that the solution is gomg to be a rather difficult matter 
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d However, before becoming discouraged too quickly, a search is made throughout the 
text to see if any isomorphs are present Fortunately there appear to be several of them 
Note the followmg 

(1) DBDDQ. GSUNSFBOBEK 

Message 1_ (2) N E VVJLKZEKUR C N I F 

(3) TNKJKUXLODLWTHCZR|endof message 

Message 2.(4) C R I I XOZETZNKj end of message 

Message 3.(5) C Q VVJLKZEKUR F R F X 


First, it 18 necessary to delimit the length of the isomorphs Isomorph (2) shows that the iso¬ 
morphism begins with the doubled letters For there is an E before the V V m that case and also 
.in E within the isomoiph, if the phenomenon included the E, then the letter immediately before 
the D D m the case of isomorph (1) would have to be an N, to match its homolog, E, in isomorph 
(2), which it is not Corroboratmg data are given by isomorphs (3), (4), and (5) m this respect 
Hence, we may take it as estabhshed that the isomorphism begms with the doubled letters 
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As for the end of the isomorphism, the fact that isomorphs (2) and (5) are the same for 10 letters 
seems to mdicate that that is the length of the isomorphism The fact that message 2 ends 2 
letters after the last “tie-m” letter, Z, corroboiates this assumption It is at least certam that 
the isomorphism does not extend beyond 11 letters because the recurrence of R m isomorph (6) 
IS not matched by the recurrence of R in isomorph (2), nor by the recurrence of T m isomorph (3) 
Hence it may be assumed that the isomorphic sequence is probably 10 letters in length, possibly 
11 But to be on safe ground it is best to proceed on the 10-letter basis 

e Applyin g the prmciples of mdirect symmetry to the superimposed isomorphs, partial 
chains of equivalents may be constructed and it happens m this case that practically the entire 
primary component may be established Let the student confirm the fact that the followmg 
sequence may be denved from the data given 

1 2 t 4 6 S 7 8 810 11 13 13 14 15 16 17 18 19 20 21 22 23 2( 28 28 

TEZKR.IVF. Q WG.NUSBXJDOL 

The only rmasiTig letters are A, C, H, M, P, and Y By use of the nearly complete sequence on the 
text It will be possible to place these 6 letters m their positions m the cipher component Or, if a 
keyword-mixed sequence is suspected, then the sequence which was reconstructed may be merely 
a decimation of the ongmal primary sequence By testmg the partial sequence for various 
mtervals, when the seventh is selected the followmg result is obtamed 

1 2 3 4 8 6 7 8 0 10 11 12 18 14 18 16 17 18 19 20 21 22 23 24 28 26 

TVWXZ..DR ULI BEFGJK NO QS 

The sequence is obviously based on the keyword HYDRAULIC, and the complete primary cipher 
component is now available The plam component is then to be reconstructed A word must 
be assumed m the text 

y A good probable word to assume for the 10-letter repetition found m messages 1 and 3 
is ARTILLERY This single assumption is sufficient to place 7 letters m the plam component 
Thus 

Key . VVJLKZEKUR . 

Plam. ARTILLERY 

Cipher.. VVJLKZEKUR 

1 2 3 4 8 6 7 8 9 10 11 12 13 14 18 16 17 18 19 20 21 22 23 24 26 26 

A E I L. .R.T .Y 

These few letters are sufficient to mdicate that the plam component is probably the normal 
direct sequence A few mmutes testmg proves this to be true The two components are there¬ 


fore 

Plam _ ABCDEFGHIJKLMNOPQRSTUVWXYZ 

Cipher. _ HYDRAULICBEFGJKMNOPQSTVWXZ 


With these two components at hand, the decipherment of the messages now becomes a relatively 
simple matter AHHunimg a smgle-letter mtroductory key, and tiymg the first five groups of 
message 1 the results are as follows 


Key . ?USYP WTRXD IMLEX RKVDB DDQGS 

Cipher._ USYPW TRSDI MLEXR KVDBD DQGSU 

Plain._ ?PHRF YIVEF IREOF LIGHT ARTIL 
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It 18 obvioiis that an introductory key of more than one letter was used, smce the first few letters 
yield unmtelligible text, but it also appears that the last cipher letter of the mtroductory key 
was used as the mtroductory key letter for enciphering the subsequent auto-keyed portion of 
the text (see par 23c (3)) However, assuming that the IVE before the word FIRE is the endmg 
of the first word of the plam text, and that this word is INTENSIVE, the mtroductory key word 
18 found to be WICKER Thus 

Key.. W I C K E Rl TRXDIMLEXRKVDBDDQGS . 

Plam_ INTENSIVEFIREOFLIGHTARTIL. 

Cipher_ USYPWTRXDIMLEXRKVDBDDQGSU , 

The begmnmgs of the other two messages are recoverable m the same way and are foimd to be 
as follows 

Key_ P R 0 M I S El RXLGHOUZO 

Plam_ REQUESTVIGOROUS 

Cipher._ BIIBFGRXLGHOUZO 


Key_ C H A R G E Dl RRVMMHCVB 


.SECONDBATTALION 

.HALOZJRRVMMHCVB 


g The example solved m the foregoing subparagraphs offers an important lesson to the 
student, insofar as it teaches him that he shovld Tiot immediately Jed discouraged when conjronted 
with a problem presenting only a small quantity of text and therefore affording what seems at first 
glance to he an insufficient quantity of data for solution For m this example, while it is true that 
there are insufficient data for analysis by simple prmciples of frequency, it turned out that 
solution was achieved without any recourse to the principles of frequency of occurrence Here, 
then, IS one of those mteresting cases of substitution ciphers of rather complex construction 
which are solvable without any study whatsoever of frequency distributions Indeed, it wdl 
be found to be true that m more than a few mstances the solution of quite complicated cipher 
systems may be accomplished not by the application of the prmciples of frequency, but by 
recourse to mductive and deductive reasomng based upon other considerations, even though 
the latter may often appear to be very tenuous and to rest upon quite flimsy supports 

29 Special case of solution of cipher-text auto-keyed cryptograms — a Two messages with 
identical plam texts enciphered accordmg to the method of paragraph 23 c (3) by mitial key 
words of different lengths and compositions can be solved very rapidly by reconstructmg the 
primary components The cryptographic texts of such messages will be isomorphic after the initial 
key-word portions Note the two foUowmg superimposed messages, m wluch isomorphism be¬ 
tween the two cryptograms is obvious after their 6th letters 


ITSBJS KBNLO CFHAZ LWJAM BNFNS MVJRE 

2BKKMJ XYCXB HRPVO XMUVI YCRCG IKUTD 


IHFPRX CPCRR 


CPCRR EHFMU HRAXC NFDUB ATFQR 
HEHTT DPRIW PTVNH CRSWY VJRFT 
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Starting with any pair of superimposed letters (begmnmg with the 7th pair), chams of equiva¬ 
lents are constructed 

1 a S 4 5 ■ 7 8 8 U 11 12 13 14 

1 _ Z 0 B Y 

2 _ LXNCHPEDSG 

8 _ QFRTJUWMI .. 

4_ A V K 

By mterpolation, these partial sequences may be united mto the key-word sequence 
HYDRAULICBEFGJKMNOPQSTVWXZ 

b The initial key words and the plam texts may now be ascertamed quite easily by 
deciphenng the messages, using this primary component shd agamst itself It will be found that 
the initial key word for the 1st message is PENCE, that for the 2d is LATERAL The reason that 
the cryptographic texts are isomorphic beyond the imtial key word portions is, of course, that 
smce the text beyond the key word is enciphered auto-key fashion by the preoedmg cipher letter 
the letters before the last letter of the key have no effect upon the encipherment at all Hence 
two messages of identical text cannot be other than isomorphic after the mitaal key-word portions 
c The foregoing solution affords a clue to the solution of cases m which the texts of two 
or more messages are not completely identical but are m part identical because they happen to 
have giTuilnr begmnmgs or endmgs, or contam nearly similar mformation or mstructions The 
progress m such cases is not so rapid as m the case of messages with wholly idenUcal texts because 
much care must be exercised m blockmg out the isomorphic sequences upon which the recon¬ 
struction of the primary components will be based 

d (1) In the foregomg cases, the primary components used to encipher the illustrative 
messages were identical mixed sequences If nomdentical components are employed, the 
cryptograms present an mteresting case for the apphcation of a prmciple pomted out m a 
precedmg text * 

(2) Suppose that the three messages of paragraph 276 had been enciphered by usmg a 
plum component different from the mixed component The encipherments of the word 
ARTILLERY would still yield isomorphic sequences, from which, as has been noted, the recon¬ 
struction of the cipher component can be accomplished 

(3) Havmg reconstructed the cipher component (or an eqmvaJent) the latter may be 

apphed to the cipher text and a “decipherment” obtamed In this process any sequence of 26 
letters may be used as the plam component and even the normal sequence A Z may be 

employed for this purpose The word decipherment m the next to the last sentence is enclosed 
by quotation marks because the letters thus obtamed would not yield plam text, smce the real 
or an equivalent plam component has not yet been found Such “deciphered” text may be 
termed spurious plam text But the important thing to note is that this text is now monoalphabefio 
and may be solved by the simple procedure usually employed in solving a monoalphabetic cipher 
produced by a single mixed alphabet Thus, a polyalphabetic cipher may be converted to mono- 
alphabetic terms and the problem much simplified In other words, here is another example 
of the situations m which the prmciple of conversion mto monoalphabetic terms may be apphed 
with gratifying success It is also an example of the dictum that the use of two differently 
jnnpA primary components does not really give much more seounty than does a mixed component 
plitlmg against itself or agamst the normal sequence 


* MUttary Cryptandlyau, Part IJ, pax iSg 
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e (1) If the auto-key method shovm in paragraph 23c (2) had been employed m enciphermg 
the two identical texts above, the solution would, of course, have been a bit more diflBcult To 
illustrate such a case, let the two texts be enciphered by key words of the same lengths but 
different compositions PENCE and LATER Thus 

No 1 


Key_ PENCE TSBJS MMNRU LPUIH JBTXF INNRM 

Plam_ REQUE STINF ORMAT lONOF SITUA TIONI 

Cipher._ TSBJS MMNRU LPUIH JBTXF INNRM DWIQV 

Key_ DWIQV PCKAO DPAZO BCMRI AFNWO GLIHT 

Plam_ NFIFT EENTH INFAN TRYSE CTORA TONCE 

Cipher..... PCKAO DPAZO BCMRI AFNWO GLIHT IWWCU 

No 2 

Key_ LATER BKKMJ RBTUX SGEBQ YRHHA TETUC 

Plam_ REQUE STINF ORMAT lONOF SITUA TIONI 

Cipher._ BKKMJ RBTUX SGEBQ YRHHA TETUC NOGTM 

Key_ NOGTM LDQLE NGBYE WDSUH PUTZE HHGDK 

Plam _ NFIFT EENTH INFAN TRYSE CTORA TONCE 

Cipher..... LDQLE NGBYE WDSUH PUTZE HHGDK TODEX 

(2) Now let the two cryptograms be superimposed and isomorphisms be sought They are 
shown underlmed below 

1 _ TSBJS MMNRU LPUIH JBTXF INNRM DWIQV 

2 _ BKKMJ R B TUX SGEBQ YRHHA TETJJC NOGTM 

1 _ PCKAO DPAZO BCMRI AFNWO GLIHT IWWCU 

2 _ LDQLE NGBYE WDSUH PUTZE HHGDK TODEX 


It will be noted that the mtervals between isomorphic superimposed pairs show a constant 
factor of 5, mdicatmg a 5-letter mtial key word 

(3) A reconstruction diagram for the pairs beyond the first five letters is established, based 
upon this mterval of 5, and is as follows 

ABCDEFGHIJKLMNOPQRSTUVWXYZ 



The eqmvalent sequence AWNBDTKIHQGUXOERVMCYSJLZPFis 
established by indirect symmetry, from this, by decimation on the eleventh mterval, the 
HYDRAULIC XZ component is recovered 

(4) It will be noted that the foregomg case, in which the imtial key words for the two crypto¬ 
grams are of the same length, is only a special apphcation of the method set forth m paragraph 
44 of Mihtary Cryptanalysis, Part II But if the key words were of different lengths, the method 
set forth m paragraph 45 of the text referred to would be applicable No example is deemed 
necessary, smce no new prmciples are mvolved 


Section VIII 

SOLUTION OF PLAIN-TEXT AUTO-KEY SYSTEMS 

Paiagiapb 
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Solution of plain-text auto-keyed cryptograms when the introductory key is a single letter.. 31 

Example of solution by the probable-word method. 32 

Concluding remarks on the solution of auto-key systems__ 33 


30 Prehmmary remarks on plam-tezt auto-keymg —a If the cipher alphabets are unknown 
sequences, plam-text auto-keymg gives nse to cryptograms of more mtiicate character than 
does cipher-text auto-keymg, as has already been stated As a cryptographic pnnmple it is 
very commonly encountered as a new and remarkable “mvention” of tyros m the cryptographic 
art It apparently gives nse to the type of reasoning to which attention has been directed 
once before and which was then shown to be a popular delusion of the unmitiated The novice 
to whom the auto-key prmciple comes as a brilliant flash of the imagmation sees only the apparent 
unpossibihty of penetratmg a secret which enfolds another secret His reasoning runs about 
as follows “In order to read the cryptogram, the would-be solver must, of course, first know 
the key, but the key does not become known to the would-be solver until he has read the crypto¬ 
gram has thus found the plam text Smce this is reasomng around a circle, the system is 
mdecipherable ” How unwarranted such reasomng really is m this case, and how readily the 
problem is solved, will be demonstrated m the next few paragraphs 

h A consideration of the mechamcs of the plam-text auto-key method discloses that a 
repetition of n letters m the plam text will produce a repetition of (n—k) letters m the cipher 
text, where n represents the length of the repetition and k the length of the mtroductory key 
Therefore, when the mtroductory key consists of a single letter there will be as many repetitions 
m the cipher text as there are m the plam text, except for true digraphic repetitions, which of 
course disappear But on the other hand some “accidental” digraphic repetitions are to be 
fairly expected, smce it can happen that two different plam-text pairs, enciphered by different 
key letters, wiU produce identical cipher eqmvalents Such accidental repetitions will happen 
less frequently, of course, m the case of longer polygraphs, so that when repetitions of 4 or more 
letters are found m the cipher text they may be taken to be true or causal repetitions It is 
obvious that m studymg repetitions m a cryptogram of this type, when the mtroductory key 
18 a smgle letter, a 5-letter repetition m the cipher text, for example, represents a 6-letter word, 
or sequence repeated m the plam text When the mtroductory key is k letters m length then 
an n-letter repetition represents an (n+I:)-letter repetition m the plam text 

e The discussion will, as usual, be divided mto two prmcipal cases (1) when the cipher 
alphabets are known and (2) when they are unknown Under each case there may be an mtro¬ 
ductory key consistmg of a single letter, a word, or a short phrase The single-letter mitial 
key will be treated first 

31. Solution of plam-text auto-keyed cryptograms when the mtroductory key is a single 
letter —a Note the followmg plam-text auto-keyed encipherment of such commonly encountered 
plam-text words as COMMANDING, BATTALION, and DIVISION, usmg two identical primary 
components, m this case direct standard alphabets 
186922—39- 1 (46) 
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( Key text- 

Plain text_ 

Cipher._ 

( Key text_ 

Plain text_ 

Cipher_ 


BATTALION Key text. DIVISION] 

-.BATTALION Plain text. DIVISION [(2) 

BTMTLTWB Cipher._ L D D A A W B j 

COMMANDING Key text_ CAPTAIN ] 

..COMMANDING Plain text _ CAPTAIN (4) 

.. . QAYMNQLVT Qpher._ C P I T I V | 


These charactenstics may be noted ‘ 

(1) The cipher equivalent of A„ is the plam-text letter which immediately precedes Ap 
(See the two A’s m BATTALION, m example 1 above ) 

(2) A plam-text sequence of the general formula ABA yields a doublet as the cipher eqmvalent 
of the final two letters (See IVI or ISI m DIVISION, example 2 above ) 

(3) Every plam-text tngraph having Ap as its central letter yields a cipher eqmvalent the 
last two letters of which are identical with the imtial and final letters of the plam-text tngraph 
(See MAN m COMMANDING, example 3 above ) 

(4) Every plam-text tetragraph having Ap as the imtial and the final letter yields a cipher 
eqmvalent the second and fourth letters of which are identical with the second and third letters 
of the plam-text tetragraph, respectively (See APTA m CAPTAIN, example 4 above, also ATTA 
m BATTALION, example 1) 

b (1) From the foregoing characteristics and the fact that a repetition of a sequence of n 
plam-text letters will yield, m the case of a 1-letter mtroductory key, a repetition of a sequence 
of flf-Z cipher letters, it is obvious that the simplest method of solvmg this type of cipher is 
that of the probable word Indeed, if the system were used for regular traffic it would not be 
long before the solution would consist merely m referring to lists of cipher eqmvalents of com¬ 
monly used words (as found from previous messages) and searchmg through the messages for 
these cipher eqmvalents 

(2) Note how easily the following message can be solved 


B E C J I 


B J W B P Q 


A Y M N Q 


HVNET WAALC 


Seeing the sequence BTMTLTWB, which is on the list of eqmvalents m a, above (see example 1), 
the word BATTALION is inserted m proper position Thus 


BECJI BTMTL TWBPQ 
B ATTAL ION 

With this as a start, the decipherment may proceed forward or backward with ease Thus 
BECJI BTMTL TWBPQ AYMNQ HVNET WAALC 
EACHB ATTAL lONCO MMAND ERWIL LPLAC 

e The foregoing example is based upon the so-called Vigen^e method of encipherment 
(0k/j=©i/i, ©p/i=0o/a) If in encipherment the plam-text letter is sought m the cipher com¬ 
ponent, its eqmvalent taken m the plam component ( 0 »/s= 0 i/i, 0p/2=0e/i)( the steps m solution 
are identical, except that the hst of cipher eqmvalents of probable words must be modified 
accordingly For mstance, BATTALION will now be enciphered 
by the sequence_ZTAHLXGZ 


* The student is cautioned that the charactenstics noted apply only to the case where two identical com¬ 
ponents are used, with the base letter A 
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d If reversed standard cipher alphabets are used, the word BATTALION 

will be enciphered by the sequence. BHATPDUB, 

which also presents idiomorphic charactenstics leadmg to the easy recogmtion of the word 

e All the foregomg phenomena are based upon standard alphabets, but when mixed cipher 
components are used and these have been reconstructed, similar observations may be recorded 
and the results employed m the solution of additional messages enciphered by the same com¬ 
ponents 

32 Example of solution by the probable-word method .—a The solution of messages 
enciphered by unknown mixed components will now be discussed by example When the pri¬ 
mary components are unknown, the observations noted under the precedmg subparagraphs are, 
of course, not applicable, nevertheless solution is not difficult Given the foUowmg three ciypto- 
grams, all mtercepted on the same day, and therefore suspected of bemg related 






Message I 






H U F I 

I 

0 C 

Q J J 

I V Z 0 Z 

V P D G 

0 

V V 

V 

K W 

U E W H 

U 

U Q H U M 

R Z V Q R 

U A K V 

D 

N N 

E 

Z V 

G J P G H 

A Y 

J D R 

U W N G R 

y S K B 

L 

Q V 

U 

X N 

P H D P 

R 

S V 

K Z P 

P P K G S 

L L P R 

V 

R B 

H 

A K 

W U A V 

W 

y U 

E Z Q 

X A P Q Y 

G P S V 

S 

F N 

R 

A K 

C I F G 

z 

U V 

C C P 

D K C W V 

X T W F 

M 

R F 

K 

B V 

R 0 Q 0 

J 

D R 

U W N 

G R Y S K 

B L 









Message II 






J U F I 

I 

0 C 

Q J J 

I V Z 0 Z 

I B F E 

J 

S U 

B 

R J 

S P K T 

s 

R Z 

V X T 

W F M R F 

Q H H F 

0 

R F 

J 

P D 

G 0 V V 

V 

K W 

U H E 

N D B D D 

R H W U 

N 

K C 

M 

P D 

G 0 V Z 

s 

E N 

D B D 

D R H W U 

N P P K 

P 

E Q 

0 

Y 





Message III 






F J U H 

F 

F K 

DEN 

A L U P Z 

K Q M V 

B 

J W 

V 

P K 

E U B D 

D 

R H 

W U M 

R H V G P 

D N C U 

J 

C D 

z 

C Y 

R H U J 

U 

F Z 

P Q P 

Y Q C Y H 

0 E Q Z 

V 

X K 

c 

Q F 

T V H N 

S 

V C 

C E J 

P E A M P 

A P 0 E 

P 

B H 

M 

V J 

U N M H 

H 

W K 

C V G 

D S W J A 

E Q Z B 

U 

F F 

Y 

U E 

Z Q X A 

P 

Q y G P A 

R P Z V X 

C F N R 

A 

K C 

I 

F G 

Z U V C 

C 

P D 

K C 0 

G J W Z H 

A P U F 

Z 

F V H A V 

X M H F 

F 

K M 

Y H S 

T B S K C 

V R Q I 

J 

Y C 

P 

Z H 

U H C B 

M 

T H 

0 F H 








b (1) There are many repetitions, their mtervals show no common factor, and a unihteral 
frequency distribution does not appear to be monoalphabetic Plam-text auto-keymg is sus¬ 
pected The simplest assumption to make at the start is that single-letter mtroductory keys 
are bemg used, with the normal Vigen^re method of encipherment, and that the plam component 
18 the normal sequence Attempts to solve any of the messages on the assumption that the 
cipher component is also the normal sequence bemg unsuccessful, it is next assumed that the 
cipher component is a mixed sequence The 13-letter repetition JDRUWNGRYS 
K B L and the 10-letter repetition PDGOVVVKWU are studied mtensively If a 
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amgle-letter mtroduotoiy key is bemg used, then these repetitions involve 14-letter and 11-letter 
plam-text sequences or words, if the normal Vigen4re method of encipherment is m effect 
(0k/a=0/ii, 0D/i=0o/»)i then the base letter is A If the latter is true then a good word which 
would fit the IS-letter repetition is 

Key_ RECONNAISSANCE 

Plain text_ RECONNAI StS A N C E . 

apher._ J D R U wjN G R y[S K B L 

and a good word which would fit the 10-letter repetition is 

Key_ OBSERVATION 

Ham text._ 0 B S E RlV A T I 0 N . 

Cipher_ P D G 0 vjv V K W U . 

(2) Inserting, m a mixed component, the values given by these two assumptions yields 
the following 


Ham_ A B 

Cipher.- 


CDEFGHIJKLMNOPQRSTUVWXYZ 
A J STINGBC KL VW Y 

DU OP 


(3) It is a simple matter to combme these two partial cipher components mto a single 
sequence, and the two components are as follows 

Ham_ ABCDEFGHIJKLMNOPQRSTUVWXYZ 

Cipher._ READJUSTINGBCFHKLMOPQVWXYZ 


(4) With the pnmary components at hand, solution of the messages is now an easy matter 
e The foregomg example uses an unkno wn mixed cipher component shding against what 
was first assumed (and later proved) to be the normal direct sequence Whwibotti pnmary com¬ 
ponents are unknown mixed sequences but are identical, solution is more difficult, naturally, 
because the results of assummg values for repeated sequences cannot be proved and established 
so qmckly as m the foregomg example Nevertheless, the general method mdicated, and the 
apphcation of the principles of mdirect symmetry will lead to solution, if there is a fair amount 
of text available for study When an mtroductoiy key of several letters is used, repetitions 
are much reduced and the problem becomes still more diffi cult, but by no means msurmountable 
Space forbids a detailed treatment of tlie method of solving these oases but it is beheved that 
the student is m a position to develop these methods and to experiment with them at his leisure 
33. Concludmg remarks on the solution of auto-key systems —a The type of solution 
elucidated m the precedmg paragraph is based upon the successful apphcation of the probable- 
word method But sometimes the latter method fails because the commonly expected words 
may not be present after all Hence, other prmciples and methods may be useful Some of 
these methods, useful m special cases, are almost mechanical m their nature Extension of the 
basic pnnciplea mvolved may lead to rather far-reachmg complexities However, because these 
methods are apphcable only to somewhat special situations, and because they are somewhat 
mvolved they will be omitted from the text proper and placed m Appendix 1 The student 
who IS especially mterested m these cases may consult that appendix at his leisure 

b. It IS thought that sufficient attention bas been devoted to the solution of both cipher-text 
and plam-text auto-key systems to have demonstrated to the student that these cryptographic 
methods have senous weaknesses which exclude them from practical usage m mihtary cryptog¬ 
raphy Besides being comparatively slow and subject to error, they are rather easily solvable, 
even when unknown cipher alphabets are employed 
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e In both systems there are characteristics which permit of identifymg a cryptogram m 
belonging to this class of substitution Both cases will show repetitions m the cipher text In 
cipher-text auto-keymg there will be far fewer repetitions than m the ongmal plam text, especially 
when mtroductory keys of more than 1-letter m length are employed In plam-text auto-kejrag 
there will be nearly as many repetitions m the cipher text as m the ongmal plam text unless 
long mtroductory keys are used In either system the repetitions will show no coMtancy as 
regards mtervals between them, and a uniliteral frequency distnbution will show such messages 
to be polyalphabeUc m nature Cipher-text auto-keymg may be distmgmshed from plam-text 
auto-keymg by the appearance of the frequency distnbution of the second member of sets of 
two letters separated by the length of the mtroductory key (see par 26A) In the case of cipher- 
text auto-keymg these frequency distnbutions will be monoalphabetic m nature, m plam-text 
auto-keymg such frequency distnbutions will not show monoalphabetic characteristics 























Section IX 


METHODS OF LENGTHENING OR EXTENDING THE KEY 

Preliminary remarks. PM»gi»ph 

Bonded and nonrepeating W^'t^rsi^criled . 

Other systems employing lengthy keying sequences___. ^ 

paragraph 16 of this text it was stated that two procedures 
sugg^t themselves for ehminating the weaknesses introduced by periodicity of the type pro- 

the W ^ destroying penodicity, by such devices as interrupting 

£ sTn! of plain text It was demonstrated that sub^ 

Ss^dL m Tv iv«t “0 “adequate to ehmmate the weaJaiesses referred to, and must be 
n^^tl^6T«rT The other alternative suggested m 

therefore remains now to be mvestigated, viz, that of lengthenmg the keys to a 

ToIveMeTffiT T? ^ r ““ount of text to enable the CTyptan^sfc to 

tSTth ‘ ^ Attempts toward this end usually consist m extending the key to^ch a iSeth 

t«« »o be Ah J:» 

t if nT too lit L r ® T if ««otence, provided 

primal In addition to the difficulties that would be encountered in 

W to b^ToTtoTS nmemomc phrases and sentences which would 

lu rlirTa IfTTf probable-word method of solution 

tT T cryptanalysts And if only a word or 

llv ct^tnaZtf "f of a fortunate assumption, it is obviL that the 

ph^^e wTb ® ““00 ““y long 

kSwn to maif^pe^e ® remembered is likely to be w^ 

order to^TuramrT' “‘’'t employmg a short nmemomc key m 

ThlbetfcTlT tT"" Ba^caUy, any method of transposition apphed to a siLle 
advTtte Tber/r?p ^ ^«y> “hoover, has^e 

exarnol^aniimAPirS? T® approachmg a random selection of letters For 

thTh l 0"0“1 ^oy may be denved from a word or a short phrase, this numencal key may 

hTbeL S^tS “ **"*“^^« ^l“oh the normal alphabet 

repeated a prewously agreed upon number of times m a normal Oeft to right) or pre- 

Te^esTiTri transposition rectangLlTbecTe 

TnTs 0?,f IT Pl“n text, using any desired type of primary com- 

^sition wffi ;irfd Tf n “ “0‘ ‘l^ought to be sufficiently secure, a doublf trans- 

eTnCid 7 f 0*1^“ ‘yPO« of transposition 

may be employed for the purpose, mcludmg yanous kmds of geometnc %ure8 Also, a non- 

ISO) 


transposition method of lengthening the keymg sequence and at the same tune mtroducing an 
irregularity, such as apenodic mterruption has already been described (see par 18) 

c Another method of deyelopmg a long key from a short mnemomc one is that shown below. 
Given the keyword CHRISTMAS, a numencal sequence is first denved and then one wntes down 
successive sections of this numencal key, these sections terminating with the successive num¬ 
bers 1, 2, 3, of the numencal key Thus 

Mnemomc key_ CHRISTMAS 

Numencal key. 2-3-6-4-7-9-5-1-8 

l|2| 3| 4| 5{ 6| 

Extendedkey_ C H R I S T M a|c|c h|c H R IJC H R I S T MjC H RJ 

7| 8| 9| 

CHRISlCHRISTMASlCHRISTj 

Thus the ongmal key of only 9 letters is expanded to one of 45 letters (1+2+3+ +9=45) 

The longer key is also an mtemipted key of the type noted under paragraph 17, but if the mes¬ 
sage 18 long enough to require several repetitions of the expanded key the encipherment becomes 
penodic and can be handled by the usual methods employed m solvmg repeatmg-key ciphers 
If the basic key is fairly long, so that the expanded key becomes a qmte lengthy sequence, then 
the message or messages may be handled m the manner explained m paragraph 20 

d Another method of producing a rather long sequence of digits for keying purposes from a 
single key number is to select a number whose reciprocal when converted by actual division mto 
its equivalent decraial yields a long senes of digits For example the reciprocal of 49, or 1/49, 
yields a sequence of 42 digits begmmng 02040815 Such a number, coupled with a 

key word hie CHRISTMAS, could be used for interrupted keying, the successive cipher alphabets 
being used for emaphenng as many letters as are indicated by the successive digits In the case 
of the example cited, the first digit is 0, hence the C alphabet would not be used The next 
digit IS 2, the H alphabet would be used for enciphering the first and second letters The third 
digit IB again 0, the R alphabet would not be used The fourth digit is 4, the I alphabet would 
be used for enciphering the third, fourth, fifth, and sixth letters, and so on 

S6. Other systems employing lengthy keying sequences —a The so-called “runmng-key" 
system —^To be mentioned m connection with this subject of extensive or lengthy keys is the 
cipher system known as the runmng-key, contmuous-key, or nonrepeatmg-key system, m which 
the key consists of a sequence of elements which never repeats no matter how long the message 
to be enciphered happens to be The most common and most practical source of such a key is 
that m which the plam text of a previously agreed-upon book serves as the source for successive 
key letters for encipherment ‘ The solution of this type of apher, an accomplishment which was 
once thought impossible, presents some mterestmg phases and will be considered shortly At this 
pomt it IS merely desired to mdicate that according to the runmng-key system the key for an 
mdividual message may be os long as the message and never repeat, but if a laa^e group of 
correspondents employ the same key sequence, it may happen that there will be several messages 
m the same key and ^ey will aU begm with the same uutial key letter, or, there will be several 
which will “overlap” one another with, respect to the key, that is, they begm at different mitial 
points m the keymg sequence but one message soon overtakes the other, so that from that pomt 
forward all subsequent letters in both messages are enciphered by the same sequence of key 
letters 

> Sec IX, Advanced Mihtary Cryptography See also footnote 8, page 71 of tins text. 
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b The so-called progressive-alphabet system —^In the so-called progressive-alphabet system 
the basic principle is quite simple Two or more primary elements are arranged or provided 
for according to a key which may be varied from time to time, the mteraction of the pnmary 
elements results m makmg available for cryptographic purposes a set of cipher alphabets, all 
the latter are employed m a fixed sequence or progression, hence the designation progressive- 
alphabet system If the number of alphabets available for such use is rather small, and if the 
text to be enciphered is much longer than the sequence of alphabets, then the system reduces 
to a penodic method But if the number of alphabets is large, so that the sequence is not 
repeated, then of course, the cryptographic text will exhibit no penodic phenomena 

c The senes of cipher alphabets m such a system constitutes a keying sequence Once set 
up, often the only remammg element m the key for a specific message is the startmg pomt m the 
sequence, that is, the imtial cipher alphabet employed m enciphenng a given message If this 
keying sequence must be employed by a large group of correspondents, and if all messages 
employ the same startmg pomt m the keymg sequence, obviously the cryptograms may simply 
be superimposed without any prehnunary testmg to ascertam proper pomts for supenmposition 
The student has already been shown how cases of this sort may be solved However, if messages 
are enciphered with varymg startmg pomts, the matter of superimposing them properly takes 
on a diflerent aspect This will soon be treated in detail 

d The respective cipher alphabets constituting the entire complement of alphabets may 
be employed m a simple progression, that is, consecutively from a preselected pomt, or, 
they may be employed according to other types of progression For example, if the system* 
comprises 100 alphabets one might use them m the sequence 1,3,5, 7, , or 1,4,7,10, , 

or irregular types of skipping may be employed 

e In addition to the foregoing, there are, of course, a great many mechamcal methods of 
producmg a long key, such as those employed m mechamcal or electrical cipher mn.i'.liinoja in 
most cases these methods depend upon tiie mteraction of two or more short, pnmary keys which 
jomtly produce a smgle, much longer, secondary or resultant key (See par 4 ) Only bnef 
reference can be made at this pomt m the ciyptanalytic studies to cases of t.bia kmd A detailed 
teeatment of complex examples would reqmre much time and space so that it will be reserved 
for subsequent texts 

y Fmally, there must be mentioned certam devices m which, as m encipherment by the 
auto-key method, the text itself serves to produce the vanation m cipher eqmvalents, by con- 
trolhng the selection of secondaiy alphabets, or by mfluencmg or determimng the sequence with 
which Aey will be employed Naturally, m such cases the key is automatically extended to a 
point where it comcides m length with that of the text An exceUent example of such a device 
is that known as the Wheatstone, the solution of which will be descnbed m its proper place * 
Some writers classify and treat this method as well as auto-key methods as forms of the runnmg- 
key system but the present author prefers to consider the latter as bemg radicaUy different m 
pnnciple from the former types, because m the true nmnmg-key system the key is whoUy external 
to and mdependent of text being enciphered This is hardly true of auto-key systems or of 
systems such as the Wheatstone mentioned herem 

* See Sec XII, Advanced Mihtary Cryptography 
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GENERAL PRINCIPLES UNDERLYING SOLUTION OF SYSTEMS EMPLOYING LONG 


OR CONTINUOUS KEYS 

Faiagrapb 

Solution when the primary components are known sequences_ 37 

Solution of a running-key cipher when an unknown but intelligible key sequence is used and the pnmary 

components are know n_ 38 

Solution of a progressive-alphabet cipher when the primary components are known_ 39 

General solution for ciphers involving a long keying sequence of fixed length and composition_ 40 


37 Solution when the primary components are known sequences — a As usual, the solution 
of cases mvolvmg long or contmuous keys wiU be treated under two headmgs First, when the 
primary components are known sequences, second, when these elements are wholly unknown 
or partially unknown 

b Smce the essential purpose m using long keys is to prevent the formation of repetitive 
cycles withm the text, it is obvious that m the case of very long keymg sequences the crypt¬ 
analyst IS not gomg to be able to take the text and break it up mto a number of small cycles 
which will permit the establishment of monoalphabetic frequency distnbutions that can readily 
be solved, an end which he can attain all the more readily if to begm with he knows the pnmary 
sequences But, lliere nearly always remains the cryptanalyst’s last resort the probable-word 
method Inasmuch as this method is apphcable to most of these cases, even to that of the 
running-key system, which perhaps represents the furthest extension of the pnnciple of long 
keying sequences, an example using a cryptogram of the latter type will be studied 

38 Solution of a runmng-key cipher when an unknown but mtelhgible key sequence 
IS used and the pnmary components are known — a In paragraph 36a mention was made of 
the so-called running-key, contmuous-key, or nonrepeating-key system, m which the plam text 
of a previously agreed-upon book serves as the source for successive k^ letters for encipherment 
Smce the runnmg-key system is entirely apenodic, and the cipher text can therefore not be 
arranged m superimposed short cycles, as m the case of the repeatmg-key system, it would 
appear on first consideration to be “mdecipherable” without the key ‘ But if the student 
will bear m mind that one of the practical methods of solvmg a repeatmg-key cipher is that of 
the probable word,* he voll immediately see that the latter method can also be apphed m 
solvmg this type of nonrepeating-key system The essence of the matter is this The 
ciyptanalyst may assume the presence of a probable word m the text of the message, if he 
knows the pnmary components mvolved, and if the assumed word actually exists m the message, 
he can locate it by checkmg agamst the key, since the latter is intelligible text Or, he may 
assume the presence of a probable word or even of a phrase such as “to the,” “of the,” etc, 
m the key text and check his assumption agamst the text of the message Once he has forced 

* At one tune, indeed, this view was current among certain cryptographers, who thought that the pnnciple 
of factonng the intervals between repetitions in the case of the repeatmg-key cipher formed the basis for the 
only possible method of solving the latter type of system Since, according to this erroneous idea, factonng 
cannot be apphed m the case of the runnmg-key system (using a book as the key), therefore solution was con¬ 
sidered to be impossible How far this idea is from the truth will presently be seen In this same connection 
see also footnote 8, page 71 

* See Military Cryptanalysts, Part II, par 25 
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such an entenng wedge into either the message or the key, he may build upon this foundation 
by extendmg his assumptions for text alternately m the key and m the message, thus gradu¬ 
ally reconstructmg both For example, given a cryptogram contammg the sequence 
HVGGLOWBESLTR , suppose he assumes the presence of the phrase THAT THE m the key text 

and finds a place m the plain text where this yields MMUNITI Thus, usmg reversed standard 
cipher alphabets 

Assumed key text. T H A T T H E 

Cipher text. HVGGLOWBESLTR 

Resultant plam text_ MMUNITI 

This suggests the word AMMUNITION The ON m the cipher text then yields PR as the begm- 
mng of the word after THE in the key text Thus 

Assumed key text. THATTHEPR 

Cipher text. HVGGLOWBESLTR 

Resultant plam text_ MMUNITION 

PR must be followed by a vowel, with 0 the most likely candidate He finds that 0 yields 7/ 
m the plam text, which suggests the word WILL The latter then yields OTEC m the key, 
makmg the latter read THAT THE PROTEC Thus 

Assumed key text_ THATTHEPROTEC 

Cipher text_ HVGGLOWBESLTR 

Resultant plam text_ MMUNITIONWILL 

This suggests the words PROTECTION, PROTECTIVE, PROTECTING, etc Thus extendmg one 
text a few letters serves to “coerce” a few more letters out of the other, somewhat as m the case 
of two boys who are r unnin g approximately abreast m a race, as soon as one boy gets a bit ahead 
the spmt of competition causes the other to overtake and pass the first one, then the latter puts 
forth a little more effort, overtakes and passes the second boy Thus the boys alternate m 
overtaking and passmg each other until the race is run The only pomt m which the simile 
fails IS that while the boys usually run forward all the time, that is, m a single direction, the 
cryptanalyst is free to work in two directions—forward and backward from an mtemal pomt 
m the message He may, m the case of the example cited above, contmue his buildmg-up 
process by addmg A to the front of MMUNITI as well as ON to the rear If he reaches the end of 
his resources on one end, there remams the other end for experimentation Ho is certainly 
unlucky if both ends termmate m complete words both for the message and for the key, leaving 
him without a single clue to the next word m either, and forcing him to a more mtensive use 
of his imagmation, gmded only by the context 

h In the foregomg illustration the cryptanalyst is assumed to have only one message 
available for his experimentation But if he has two or more messages which either begin at 
identical imtial pomts with reference to the key, or overlap one another with respect to the key, 
the reconstruction process desenbed above is, of course, much easier and is accomplished much 
more quickly For if the messages have been correctly superimposed with reference to the key text, 
the addition of one or two letters to the key yields suggestions for the assumption of words in several 
messages The latter lead to the addition of several letters to the key, and so on, m an ever- 
widening circle of ideas for further assumptions, smee as the process contmues the context 
affords more and more of a basis for the work 
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c Of course, if sufficient of the key text is reconstructed, the cryptanalyst might identify 
the book that is being used for the key, and if available, his subsequent labors are very much 
simplified 

d AU the foregomg is, however, dependent not only upon the use of an mteUigible text as 
the keymg text but also upon havmg a knowledge of the primary components or cipher alpha¬ 
bets employed m the encipherment Even if the primary components are differently mixed 
sequences, so long as they are known sequences, the procedure is qmte obvious m view of 
the foregomg explanation The trammg the student has already had is beheved sufficient to 
mdicate to him the procedure he may foUow in that solution, and no further details will here be 
given m reject to such cases But what if the pnmary components are not known sequences? 
This contingency will be treated presently 

39. Solution of a progressive-alphabet cipher when the cipher alphabets are known — a 
Taking a very simple case, suppose the mteractmg elements referred to m paragraph 366 consist 
merely of two pnmary cipher components which shde agamst each other to produce a set of 26 
secondary cipher alphabets, and suppose that the simplest type of progression is used, viz, the 
cipher alphabets are employed one after the other consecutively Beguming at an imtial 
juxtaposition, produemg say, alphabet 1, the subsequent secondary alphabets are m the sequence 
2, 3, 26, 1, 2, 3, , and so on If a different imtial juxtaposition is used, say alphabet 10 

IS the first one, the sequence is exactly the same as before, only begmnmg at a different pomt 
6 Suppose the two pnmary components are based upon the keyword HYDRAULIC A 
message is to be enciphered, begmnmg with alphabet 1 Thus 

Ham component_-H YDRAULICBEFGJKMNOPQSTVWXZHYD 

Cipher component..H YDRAULICBEFGJKMNOPQSTVWXZ 


Letter No_ 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 

Alphabet No_ 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 

Plam text. ENEMYHASPL A C E D H E A V Y I N 

Cipher text_ EOGPUUEYHM K Q V M K Z S J Q H E 

Letter No. 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 

Alphabet No.... 22 23 24 25 26 1 2 3 4 5 6 7 8 9 10 11 12 13 

Ham text. TERDICTIONFIREUPON 

Ciphertext_ NLHHLCVBSSNJEPKDDD 

Letter No__ 40 41 42 43 44 45 46 47 48 49 50 51 52 53 

Alphabet No... 14 15 16 17 18 19 20 21 22 23 24 25 26 1 

Plam text.. ZANESVILLEROAD 

Ciphertext_ GPUHFKHHYLHMRD 


e This method reduces to a penodic system mvolvmg 26 secondary cipher alphabets and 
the latter are used m simple progression It is obvious therefore that the Ist, 27th, 53d, 
letters are in the 1st alphabet, the 2d, 28th, 64th, letters are m the 2d alphabet, and so on 

d To solve such a cryptogram, knowing the two primary components, is hardly a problem 
at all The only element lackmg is a knowledge of the startmg pomt But this is not neces¬ 
sary, for merely by completmg the plain-component sequences and examinmg the diagonals of 
the diagram, the plam text becomes evident For example, given the followmg HID C T 
E H U XI Completmg the plam-component sequences mitiated by the successive cipher letters, the 
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plain text, ENEMYMACHI is seen to come out in successire steps upward in Figure 
10 Had the cipher component been shifted m the opposite direction m encipherment, the steps 
would have been downward instead of upward If the shdmg strips had been set up according to 
the sequence of cipher letters but on a diagonal, then, of course, the plam-text letters would 
have reappeared on one generatrix 

e The student will understand what simple modifications m 
procedure would be required in case the two primary components 
were different mixed sequences But what if the primary com¬ 
ponents are not known sequences’ How does the cryptanalyst 
proceed m that case? 

40. General solution for ciphers mvolvmg a long-keymg 
sequence of fixed length and composition — a It is obvious, as 
stated at a previous pomt, that no matter how the keymg sequence 
IS derived, if all the correspovdenis employ the same key, or %j this key is 
used many times by a single office, and if tt ahmys begins at the same 
point, the various messages may simply be superimposed Thus, their 
respective 1st, 2d, 3rd, letters will aU fall withm columns 

which have been enciphered by the Ist, 2d, 3rd, key letters 
If there is a sufficient number of messages, solution then becomes 
possible by frequency analysis of the successive columns—^no matter 
how long the keymg sequence may be, and regardless of whether the keymg sequence constitutes 
mtelligible text or is a purely random sequence of letters This method of solution by supenmposi- 
tion has already been outhned m paragraph 20 and no further reference to it need here be made 
b But now suppose that the keymg sequence does not always begm at the same pomt for 
all messages Suppose the several correspondents are able to select at wiU any pomt m the 
keymg sequence as the pomt of departure m encipherment Thus, such a keymg sequence, if re¬ 
garded as partakmg of the nature of a circle, will afford as many possible startmg pomts as there 
are letters or characters m that sequence Now if there are no external indications or vndneaiors * 
m the cryptograms pertammg to such a system, such as would afford enemy cryptanalysts direct 
and definite information with regard to the imtial keymg element for each cryptogram, then it 
would seem as though the supenmposition of messages (to bring letters enciphered by the same 
cipher alphabets witbm the same columns) would be difficult or impossible, and therefore that 
attempts at solution are blocked at their very begmnmg This, however, is not the end of the 
story For suppose two of the messages have m common only one polygraph, say of 6 letters, 
these two messages may be juxtaposed so as to brmg these repetitions mto supenmposition 
Thus, the possession of this long polygraph m common serves to “tie” these two messages to¬ 
gether or to “mterlock” them Then, suppose a shorter polygraph, say of 4 letters, is possessed 
m common by one of these two messages and a third message, this will serve to tie m the latter 
with the first two Extension of this process, mcludmg the data from shorter repetitions of 
tngraphs and digraphs, will serve to assemble a whole set of such messages m proper super- 
imposition Therefore, the first step is to examme all the messages for repetitions 

* IndioatoTS play an important rOIe m practical cryptography An indicator is a symbol (consisting of a 
letter, group of letters, a figure or a group of figures) which indicates the specifio key used under the general 
cryptograph'c system, or it may indicate which one of a number of general systems has been used, or it may indi¬ 
cate both 
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e When such repetitions are found, and if there are plenty of them so that assumptions for 
probable words are easy to make, it is clear that the correct assumptions will enable the crypt¬ 
analyst to set up plam-cipher eqmvalencies which will make it possible to reconstruct the pri- 
maiy components Depending upon the type used, the prmciples of direct or mdirect sym¬ 
metry of position will be very useful m this process 

d But if it happens that there are no polygraphs by means of which two or more messages 
may be tied together and properly superimposed, the simple methods mentioned m subparagraphs 
Or-c cannot here be applied However, although the road toward a solution seems to be blocked 
rather effectively, there is a detour which presents rather mterestmg vistas The latter are 
really of such importance m cryptanalysis as to warrant detailed treatment 
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41. The basic theory of the coincidence or k (kappa) test —a In Appendix 2 of the pre¬ 
ceding text ‘ certain simple applications of the theory of probability were presented for the 
student’s consideration, by way of pomtmg out to him the important role which certam phases 
of that branch of mathematics play m cryptanalysis Reference was there made to the subject 
of coincidences and its significance m connection with the study of repetitions m ciyptograms 
In this section the matter wiU be pursued a few steps further 

h In the appendix referred to, it was shown that the probabihty of monographic comcidence 

(1) m random text employmg a 26-letter alphabet is 0385, (2) m Enghsh telegraphic plam text, 
0667 These two parameters were represented by the symbols and respectively The 
important role which these values play m a certam cryptanalytic test will now be explamed 

c One of the most important techmques m cryptanaJytics is that known as applying the 
coincidence or “kappa test ” This test is useful for several cryptanalytic purposes and one of 
the most important of them is to ascertam when two or more sequences of letters are correctly 
superimposed By the word “correct” m this case is merely meant that the sequences are so 
arranged relative to one another as to facilitate or make possible a solution The test has for 
Its theoretical basis the foUowmg circumstances 

(1) If any two rather lengthy sequences of characters are superimposed, it wiU be found, 
on examinmg both members of the successive pairs of letters brought mto vertical juxtaposition, 
that in a certain number oj cases the two superimposed letters wiU coincide 

(2) If both sequences of letters constitute random text (of a 26-letter alphabet), there will 
be about 38 or 39 such cases of comcidence per thousand pairs exammed This, of course, is 
because «,= 0385 

(3) If both sequences of letters constitute plam text, there wdl be about 66 or 67 such cases 
of comcidence per thousand pairs exammed This is because x, is 0667 

(4) If the superimposed sequences are wholly monoalphabetic encipherments of plam 
text by the same cipher alphabet, there will still be about 66 or 67 cases of comcidence m each 
1,000 cases exammed, because m monoalphabetic substitution there is a fixed or unvarymg 
relation between plam-text letters and ciphei letters so that for statistical purposes monoalpha¬ 
betic cipher text behaves just the same as if it were normal plam text 

(5) Even if the two superimposed sequences are not monoalphabetically enciphered texts, 
but are poIyaJphabetic in character, there will still be about 66 or 67 cases of identity between 
supenmposed letters per thousand cases exammed, provided the two sequences reaUy belong to the 
same cryptographic system and are supenmposed at the proper point with respect to the keying 
sequence The reasons for this will be set forth m the succeeding subpaiagraphs 

' MiMary Cryptanedysia, Part II It is recommended that the student refresh his memory by reviewing 
that appendix 


( 58 ) 


59 


(6) Consider the two messages below They have been enciphered polyalphabetically by 
the same two primary components shdmg against each other The two messages use the same 
keying sequence, beginning at the same mitial pomt m that sequence Consequently, the two 
messages are identically enciphered, letter for letter, and the only differences between them are 
those occasioned by differences m plam text 


Alphabets_ i# si u s # 4 i7 w a a a • s e is is i 7 » e 

No 1 Plam text. _ WHENINTHECOURSELONGM 

Cipher._ E QJS BTFYRCXXLQJNZOYAW 

Alphabets - is si is s s 4 w w si si s s s e is is i 7 is s 

No 2 Plam text_ THEGENERALABSOLUTELY 

Cipher._ P Q_Ji TUFBWDJLQHYZPTMQI 


Note, now, that (a) m every case m which two supenmposed cipher letters are the same, the 
plam-text letters are identical and (b) m every case m which two supenmposed cipher letters 
are different, the plam-text letters are difterent In such a system, even though the cipher 
alphabet changes from letter to letter, the number of cases of identity or comcidence m the two 
members of a pair of superimposed cipher letters will still be about 66 or 67 per thousand cases 
exammed, because the two members of each pair of supenmposed letters are in the same cipher 
alphabet and it has been seen in (4) that in monoalphabetic cipher text k is the same as for plain 
teat? m, 0667 The two messages may here be said to be supenmposed “correctly,” that is, 
brought mto proper juxtaposition with respect to the keymg sequence 

(7) But now suppose the same two messages are supenmposed “mcorrectly,” that is, they 
are no longer m proper juxtaposition with respect to the keymg sequence Thus 


Alphabets._ i« 21 i» s e 4 17 19 21 21 2 e 3 s is 13 1 7 12 

No 1 Plam text._ WHENINTHECOURSELONG 

Cipher._ EQNBTFYRCXX L_2 J N Z 0 Y A 

Alphabets- w 21 is s « 4 17 w 21 21 2 b 3 « is is 1 7 

No 2 Plam text_ THEGENERALABSOLUTE 

Cipher_ PQNTUFBWDJ L_Q H Y Z P T M 


It IS evident that the two members of every pair of supenmposed letters are no longer m the 
nftiTiA cipher alphabet, and therefore, if two supenmposed cipher letters are identical this is 
merely an “accident,” for now there is no basic or general cause for the similanty, such as is 
true m the case of a correct supenmposition The similanty, if present, is, as already stated, 
due to chance and the number of such cases of similanty should be about the same as though 
the two cipher letters were drawn at random from random text, m which 0385 It is no 
longer true that (a) m every case m which two supenmposed cipher letters are the same, the 
plam-text letters are identical, or (b) m every case m which two supenmposed cipher letters are 
different, the plam-text letters are different Note, for example, that the supenmposed T,’s repre¬ 
sent two different plam-text letters and that the Sp of the word COURSE m the first message gives 
J, while the S of the word ABSOLUTELY m the second message gives H, Thus, it becomes clear 
that m an mcorrect supenmposition two different plam-text letters enciphered by two different 
alphabets may “by chance” produce identical cipher letters, which on supenmposition yield a 

* The fact that m this case each monoalphabet contains but two letters does not aflFect the theoretical value 
of «, and whether the actual number of ooincidenoes agrees closely with the expected number based upon «= 
0667 depends upon the lengths of the two supenmposed sequences 



















coincidence having no external indications as to dissiimlanty m plam-text equivalents Hence, 
if there are no other factors which enter into the matter and which might operate to distort 
the results to be expected from the operation of the basic factor, the expected number of cases of 
identical cipher letters brought together by an mcorrect supenmposition will be determmed by 
the value 0385 

(8) But now note also that m the foregomg mcorrect supenmposition there are two Zg’s and 
that they represent the same plam-text letter L This is occasioned by the fact that the plam- 
text messages happened to have L’s m ]ust those two places and that the cipher alphabet hap¬ 
pened to be the same both times Hence, it becomes clear that the same cipher alphabet brought 
mto play twice may “by chance” happen to encipher the same plam-text letter both times, thus 
producing identical cipher letters In some systems this source of identity m supenmposed 
cipher letters is of little importance, m other systems, it may materially affect the actual number 
of comcidences For instance, if a system is such that it produces a long secondaiy keymg cycle 
composed of repetitions of short pnmary keymg cycles, an mcorrect supenmposition of two 
cryptograms may bring mto juxtaposition many of these short cycles, with the result that the 
actual number of cases of identical supenmposed cipher letters is much greater than the ex¬ 
pected number based upon k,= 0385 Thus, this source for the production of identical cipher 
letters m an mcorrect supenmposition operates to mcrease the number of cases to be expected 
from the fundamental constant k,= 0385 

(9) In some systems, where nonrelated cipher alphabets are employed, it may happen 
that two identical plam-text letters may be enciphered by two different cipher alphabets which, 
“by chance,” have the same eqmvalent for the plam-text letter concerned This is, however, 
a function of the particular cryptographic system and can be taken mto account when the 
nature of the system is known 

(10) In general, then, it may be said that m the case of a correct supenmposition the 
probabihty of identity or comcidence m supenmposed cipher letters is 0667, in the case of an 
mcorrect supenmposition, the probabihty is at least 0385 and may be somewhat greater, de- 
pendmg upon special circumstances The foregomg situation and facts make possible what 
has been referred to as the “comcidence test ” Sin^'c this test uses the constant k, it is also 
called the “kappa test ” 

d The way m which the comcidence test may be apphed wiU now be explamed The 
statement that Kj,= 0667 means that m 1,000 cases where two letters are drawn at random 
from a large volume of plam text, there will be about 66 or 67 cases m which the two letters 
coincide, that is, are identical Nothmg is specified as to what the two letters shall be, they 
may be two Z’s or they may be two E’s This constant, 0667, really denotes a percentage 
If many eompansona of single letters are made, the letters bemg drawn at random from among 
those constitutmg a large volume of plam text, 6 67 percent of these compansons made will 
yield comcidences So, if 2,000 such compansons are made, the theory mdicates that there 
should be about 0667X2,000—133 comcidences, if there is sufficient text to permit of makmg 
20,000 compansons, there should be about 1,334 comcidences, and so on 

e Another way of handling the matter is to find the ratio of the observed number of co¬ 
mcidences to the total number of cases m which the event m question might possibly occur, i e , 
the total number of compansons of supenmposed letters When this ratio is closer to 0667 
than it IS to 0385 the correct supenmposition has been ascertained This is true because m 
the case of a correct supenmposition both members of each pair of supenmposed letters actually 
belong to the same monoalphabet and therefore the probabihty of their comcidmg is 0667, 
whereas m the case of an mcorrect supenmposition the members of each pair of supenmposed 
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letters belong, as a general rule, to different monoalphabets and therefore the probabihty of 
their comcid^ is nearer 0385 than 0667 

/. From the foregomg, it becomes dear that the kappa test mvolves ascertaining the total 
number of compansons that can be made m a given case, as well as ascertainmg the actual number 
of comcidences m the case under consideration When only two messages are supenmposed, 
t.hia IS easy The total number of compansons that can be made is the same as the number of 
supenmpoi^ pairs of letters But when more than two messages are supenmposed m a mper- 
xmposdwn diagram it is necessary to make a simple calculation, based upon the fact that n 

letters yidd ^ pairs or compansons, where n is the number of letters m the column * For 
example, m the case of a column of 3 letters, there are ^^^ ==3 compansons This can be 

checked by noting that the Ist letter m the column may be compared with the 2d, the 2d with 
the 3d, and the 1st with the 3d, makmg 3 compansons m all The number of compansons per 
column times the number of columns m the supenmposition diagram of letters gives the total 
number of compansons The extension of this reasonmg to the case where a supenmposition 
diagram !>«»« columns of vanous lengths is qmte obvious one merely adds together the number of 
compansons for columns of different lengths to obtam a grand total For convemence, the 
following bnef table is given 



g In ascertainmg the number of comcidences m the case of a column contammg several 
letters, it is agam necessary to use the formula only m this case n is the number oi 

identical letters m the column The reasonmg, of course, is the same as before The total 

• The qualifying phrase “as a general rule” is intended to cover any distortion m results occasioned by the 
presence of an unusual number of those cases of coincidence described under subpar c (8) and (9) 

* This has already been encountered (footnote 3, Appendix 2, Mthtary Cryptanalysts, PaH 11) It is merely a 

special case under the general formula for ascertainmg the number of combinations that may be made of n 
different r at a tune, which is studying comcidences by the method mdicated, 

smce only two letters are compared at a time, r is always 2, hence the expression which is the same as 

becomes by cancellation of (n—2)>, reduced to - 
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number of comcidences is the sum of the number of comoidences for each case of identity For 
example, m the column shown at the side, contaimng 10 letters, there are 3 B’s, 2 C’s, 4 K’s, and 
1 Z The 3 B’s yield 3 comcidences, the 2 C’s yield 1 comcidence, and the 4 K’s yield 6 
C comcidences The sum of 34-1+6 makes a total of 10 comcidences m 45 comparisons 

K 42. General procedure to be followed m makmg the k test .—a The steps m applymg 

B the foregomg prmciples to an actual case will now be descnbed Suppose several messages 

K enciphered by the same keymg sequence but each beginning at a different pomt m that 

Z sequence are to be solved The indicated method of solution is that of superimposition, 

K the problem being to detennme just where the respective messages are to be superimposed 

C so that the cipher text withm the respective columns formed by the superimposed messages 

B will be monoalphabetic From what has been mdicated above, it will be understood that 

B the various messages may be shifted relative to one another to many different pomts of 

K supermiposition, there bemg but one correct superimposition for each message with respect 

to all the otheis First, all the messages are numbered according to their lengths, the long¬ 
est bemg assigned the number 1 Commencing with messages 1 and 2 , and keepmg number 1 in 
a fixed position, message 2 is placed under it so that the mitial letters of the two messages comcide 
Then the two letters formmg the successive pairs of superimposed letters are exammed and the 
total number of cases m which the superimposed letters are identical is noted, this givmg the 
observed number of comcidences Next, the total number of superimposed pairs is ascertamed, 
and the latter is multiphed by 0667 to find the expected number of comcidences If the observed 
number of comcidences is considerably below the expected numher, or if the ratio of the observed 
number of comcidences to the total number of comparisons is nearer 0385 than 0667, the 
superimposition is mcorrect and message 2 is shifted to the next superimposition, that is, so 
that its first letter is under the second of message 1 Agam the observed number of comcidences 
IS ascertamed and is compared with the expected numher Thus, by shifting message 2 one 
space at a time (to the nght or left relative to message 1 ) the comcidence test finally should 
mdicate the proper relative positions of the two messages When the correct pomt of super- 
imposition IS reached the cryptanalyst is larely left m doubt, for the results are sometimes qmte 
starthng After messages 1 and 2 have been properly superimposed, message 3 is tested first 
against messages 1 and 2 separately, and then agamst the same two messages combmed at their 
correct superimposition Thus message 3 is slufted a step each tune until its correct position 
with respect to messages 1 and 2 has been found Then message 4 is taken and its proper pomt 
of superimposition with respect to messages 1, 2, and 3 is ascertamed The process is contmued 
m this manner until the correct pomts of superimposition for all the messages have been found 
It IS obvious that as messages are added to the superimposition diagram, the determmation of 
correct pomts of superimposition for subsequent messages becomes progressively more certam 
and therefore easier 

b In the foregomg procedure it is noted that there is necessity for repeated displacement 
of one message agamst another or other messages Therefore, it is advisable to transcnbe the 
messages on long stnps of cross-section paper, joining sections accurately if several such strips 
are necessary to accommodate a long message Thus, a message once so transcribed can be 
shifted to vanous pomts of superimposition relative to another such message, without repeatedly 
rewntmg the messages 

c Machmery for automatically comparing letters m applymg the comcidence test has been 
devised Such machmes greatly facihtate and speed up the procedure 

■ At first thought the student might wonder why it is advisable or necessary to test message 3 against message 
1 and message 2 separately before testing it against the combination of messages 1 and 2 The first two tests, 
it seems to him, might be omitted and time saved thereby The matter will be explained in par 4:3f (3) 
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43. B yamplft of apphcation of the k test —a With the foregomg m mmd, a practical example 
will now be given The following messages, assumed to be the first 4 of a senes of 30 messages, 
supposedly enciphered by a long kejnng sequence, but each message commencmg at a different 
pomt m that sequence, are to be arranged so as to bring them into correct superimposition 


Messaqb 1 


P G L P N 

H U 

F R K 

S A U Q Q 

A Q Y U 

0 

z 

A 

K 

G 

A 

E 

0 Q 

C 

N 

P R K 0 
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H 

Y 

E 

I 

U 

Y N B 

0 N 

N F 

D 

M 

W 

Z 

L 

U 

K Q 

A Q 

A H 

Z 

M G C D 

S 

L 

E 

A 

G 

C 

J P 

I 

V J 

W V A 

U 

D 

B 

A 

H 

M 

I 

H 

K 

0 

R 

M 

L T F Y Z 

L 

G 

S 

0 

G 

K 


























Message 2 














C W H P 

K 

K 

X 

F 

L 

U 

M K 

U R Y 

X C 

0 

P 

H 

W 

N 

J 

U 

W 

K 

W 

I 

H 

L 

0 K Z T 

L 

A 

w 

R 

D 

F 

G D 

D 

E Z 

D L 

B 

0 

T 

F 

U 

Z 

N 

A 

S 

R 

H 

H 

J 

N G U Z 

K 

P 

R 

C 

D 

K 

Y 0 

0 

B V 

D D 

X 

c 

D 

0 

G 

R 

G 

I 

R 

M 

I 

C 

N 

H S G G 

0 

P 

Y 

A 

0 

Y 

X 


























Message 3 














W F W T 

D 

N H 

T 

G 

M 

R A 

A 

Z G 

P J 

D 

s 

Q 

A 

U 

P 

F 

R 

0 

X 

J 

R 

0 

H R Z W 

C 

Z 

S 

R 

T 

E 

E E 

V 

P X 

0 A 

T 

D 

Q 

L 

D 

0 Q 

Z 

H 

A 

W 

N X 

T H D X L 

H 

Y 

I 

G K 

V Y Z 

W X 

B K 

0 Q 

0 

A 

Z 
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T 

N A 

L 

T 

C N Y E H 

T 

S 

C 

T 




























Message 4 














T U L D 

H 

N Q E 

Z 

Z 

U T 

Y 

G D 

U E 

D 

U 

p 

S 

D 

L 

I 

0 

L 

N 

N 

B 

0 

N Y L Q Q 

V Q 

G 

C 

D 

U T 

U 

B Q 

X S 

0 

S 

K 

N 

0 

X 

U 

V 

K 

C 

Y 

J 

X 

C N J K 

S 

A 

N G 

U 

I 

F T 

0 

W 0 

M S 

N 

B 

Q 

D 

B 

A 

I 

V 

I 

K 

N 

ff G 

V S H I 

E 

P 























b Supenmposmg • messages 1 and 2, begmnmg with their 1 st letters, 

S 10 15 » 25 30 85 

No 1_ PGLPNHUFRKSAUQQAQYUOZAKGAEOQCNPRKOV 

No 2_ CWHPKKXFLUMKURYXCOPHWNJUWKWIHLOKZTL 

No 1. HYEIUYNBONNFDMWZLUKQAQAHZMGCDSLEAGC 

No 2_ AWRDFGDDEZDLBOTFUZNASRHHJNGUZKPRCDK 

75 so 86 M 86 100 

No 1_ JPIVJWVAUDBAHMIHKORMLTFYZLGSOGK 

No 2_ YOOBVDDXCDOGRGIRMICNHSGGOPYAOYX 

the number of comcidences is found to be 8 Smce the total number of comparisons is 101 , the 
expected number, if the supenmposition were correct, should be 101X 0667=6 7367, or about 
7 comcidences The fact that the observed number of comcidences matches and is even greater 
t.h ffTi the expected number on the very first tnal creates an element of suspicion such good 
fortune is rarely the lot of the practical cryptanalyst It is very unwise to stop at the first tnal, 
even %j the results are favorable, for this close agreement between theoretical and actual numbers 

* The student will have to imagine the messages written out as continuous sequences on cross-section paper 
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of coincidences might just be "one of those accidenta ” Therefore message 2 is shifted one 
space to the right, placmg its 1 st letter beneath the 2 d letter of message 1 Agam the number 
of comcidences is noted and this time it is found to be only 4 The total number of compansons 
IS now 100 , the expected number is still about 7 Here the observed number of comcidences is 
considerably less than the expected number, and when the relatively small number of com- 
pansons is home m mmd, the discrepancy between the theoretical and actual results is all the 
more stnkmg The hasty cryptanalyst might therefore jump to the conclusion that the 1 st 
supenmposition is actually the correct one But only two tnals have been made thus far and 
a few more are still advisable, for m this scheme of supenmposmg a senes of messages it is 
absolutely essential that the very first supenmpositions rest upon a perfectly sound foundation- 
otherwise subsequent work will be veiy difiicult, if not entirely frmtless Additional tnals will 
therefore be made 

c Message 2 is shifted one more space to the right and the number of comcidences is now 
found to be only 3 Once agam message 2 is shifted, to the position shown below, and the 
observed number of comcidences jumps suddenly to 9 


No 1 .... 
No 2 .... 


P G 


s 10 IS 20 28 30 

lpnhufrksauqqaqyuozakgaeoqcnprk 

CWHPKKXFLUMKURYXCOPHWNJUWKWIHL 


36 

0 V 
0 K 


^0 45 so 88 00 05 70 

HYEIUYNBONNFDMWZLUKQAQAHZMGCDSLEAGC 

ZTLAWRDFGDDEZDLBOTFUZNASRHHJNGUZKPR 


80 88 00 95 100 

JPIVJWVAUDBAHMIHKORMLTFYZLGSOGK 

CDKYOOBVDDXCDOGRGIRMICNHSGGOPYAOYX 


The total number of compansons is now 98, so that the expected number of comcidences is 98X 
0667=6 5366, or still about 7 The 2d and 3d supenmpositions are defimtely mcorrect, as to 
the 1st and 4th, the latter gives almost 30 percent more comcidences than the former A gnin 
considenng the relatively small number of compansons, this 30 percent difference m favor of 
the 4th supenmposifaon as against the 1 st is important Further detailed explanation is unneces¬ 
sary, and the student may now be told that it happens that the 4 th supenmposition is really 
correct, if the messages were longer, all doubt would be dispelled The relatively large number 
of comcidences found at the 1 st supenmposition is purely accidental m this case 

d The phenomenon noted above, wherem the observed number of comcidences shows a 
sudden mcrease m movmg from an mcorrect to a correct supenmposition is not at all unusual, 
nor should it be unexpected, because there is only one correct supenmposition, while aU other 
supenmpositions are entirely mcorrect In other words, a supenmposition is either 100 percent 
COTect or 100 percent wrong—and there are no gradations between these two extremes 
Theoretically, therefore, the difference between the correct supenmposition and any one of the 
many mcorrect supenmpositions should be very marked, smce it Mows from what has been 
noted above, that one cannot expect that the discrepancy between the actual and the theoretical 
number of comcidences should get smaUer and smaller as one approaches closer and closer to 
the correct supenmposition» For if letters belongmg to the same cipher alphabet are regarded 


» The importance of this remark will be appreciated when the student 
which statistical expectations have a better opportunity to matenahre 


comes to study longer examples, m 
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as bemg members of the same family, so to speak, then the two letters formmg the successive 
pairs of letters brought mto supenmposition by an mcorrect placement of one message relative 
to another are total strangers to each other, brought together by pure chance This happens 
time and agam, as one message is slid against the other—until the correct supenmposition is 
reached, whereupon m etery case the two superimposed letters belong to the same family There 
may be many different famihes (cipher alphabets) but the fact that m every case two members 
of the same family are present causes the marked jump m number of comcidences 

e In shifting one message agamst another, the cryptanalyst may move to the nght con¬ 
stantly, or he may move to the left constantly, or he may move alternately to the left and nght 
from a selected initial pomt Perhaps the latter is the best plan 

/ ( 1 ) Having properly superimposed messages 1 and 2 , message 3 is next to be studied 
Now it IS of course possible to test the lattei message agamst the combmation of the former, 
without further ado That is, ascertaimng merely the total number of comcidences given by the 
supenmposition of the 3 messages might be thought sufficient But for reasons which will 
soon become apparent it is better, even though much more work is involved, first to test message 
3 agamst message 1 alone and agamst message 2 alone This will really not mvolve much addi¬ 
tional work after all, smce the two tests can be conducted simultaneously, because the proper 
supenmposition of messages 1 and 2 is already known If the tests agamst messages 1 and 2 
separately at a given supenmposition give good results, then message 3 can be tested, at that 
supenmposition, agamst messages 1 and 2 combined That is, all 3 messages are tested as a 
smgle set Smce, accordu^ to the scheme outhned, a set of three closely related tests is mvolved, 
one mi g ht as well systematize the work so as to save time and effort, if possible With this m 
view a diagram such as that shown in Figure 1 la is made and m it the comcidences are recorded 
in the appropnate cells, to show separately the comcidences between messages 1 and 2, 1 and 3, 
2 and 3, for each supenmposition tested The number of talhes m the cell 1-2 is the same at 
the begmnmg of aU the tests, it has already been found to be 9 Therefore, 9 talhes are inserted 
m cell 1-2 to begm with A column which shows identical letters m messages 1 and 3 yields a 
smgle tally for cell 1-3, a column wluch shows identical letters m messages 2 and 3 snelds a smgle 
tally for cell 2-3 Only when a supenmposition yields 3 identical letters m a column, is a tally 
to be recorded simultaneously m cells 1-3 and 2-3, smce the presence of 3 identical letters in the 
column yields 3 comcidences 


1 2 3 
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(2) Let message 3 be placed beneath messages 1 and 2 combmed, so that the Ist letter of 
message 3 falls under the Ist letter of message 1 (It is advisable to fasten the latter m place 
so that they cannot easily be disturbed ) Thus 

1 2 S < * « 7 8 9 10 11 12 18 14 15 16 17 18 19 20 31 83 33 24 25 2R 27 

1 . PGLPNHUFRKSAUQQAQYUOZAKGAEO 

2 - CWHPKKXFLUMKURYXCOPHWNJU 

3 - WFWTDNHTGMRAAZGPJDSQAUPFROX 

28 29 30 31 32 33 34 35 35 37 38 39 40 41 42 43 44 45 46 47 48 49 50 61 52 53 M 

1 . QCNPRKOVHYEIUYNBONNFDMWZLUK 

2 . WKWIHLOKZTLAWRDFGDDEZDLVOTF 

3 - JROHRZWCZSRTEEEVPXOATDQLDOQ 

55 56 57 58 59 60 61 62 63 64 85 60 67 68 60 70 71 72 73 74 75 76 77 78 79 80 81 

1 - QAQAHZMGCDSLEAGCJPIVJWVAUDB 

2 - UZNASRHHJNGUZKPRCDKYOOBVDDX 

3 . ZHAWNXTHDXLHYIGKVYZWXBKOQOA 

82 83 84 86 88 87 88 89 90 91 92 98 94 96 96 97 98 99 100 101 102 103 104 

1 .ahmihkormltfyzlgsogk 

2 . cdogrgirmicnhsggopyaoyx 

3 . ZQNDTNALTCNYEHTSCT 

1 2 3 


2 

3 


Fighbk 115 

The successive columns are now exammed and the comcidences are recorded, remembering that 
only comcidences between messages 1 and 3, and between messages 2 and 3 are now to be tabu¬ 
lated m the diagram The results for this first test arc shown m Figure lift This supeiim¬ 
position yields but 3 comcidences between messages 1 and 3, and the same number between 
messages 2 and 3 The total numbers of comparisons are then noted and the followmg table 
IS drawn up 
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(3) The reason for the separate tabulation of comcidences between messages 1 and 3, 
2 and 3, and 1, 2, and 3 should now be apparent Whereas the observed number of comcidences 
IS 57 percent below the expected number of comcidences in the case of messages 1 and 3 alone, 
and 60 percent below in the case of messages 2 and 3 alone, the discrepancy between the expected 
and observed numbers is not quite so marked (-21 percent) when all three messages are con¬ 
sidered together, because the relatively high number of comcidences between messages 1 and 2, 
which are correctly superimposed, serves to counterbalance the low numbers of comcidences 
between 1 and 3, and 2 and 3 Thus, a mred supenmposdwn Jor one oj the three comhnaturns 
may yield such good results as to mask the bad results for the other two combiruaions 

(4) Message 3 is then shifted one space to the right, and the same procedure is followed as 
before The results are shown below 

PGLPNHUFRKSAUQQAQYUOZAKGAEOQCNPRKOV 

cwhpkkxflumkuryxcophwnjuwkwihlok 

WFWTDNHTGMRAAZGPJDSQAUPFROXJROHRZW 

hyeiuynbonnfdmwzlukqaqahzmgcdsleagc 
ztlawrdfgddezdlbotfuznasrhhjnguzkpr 

CZSRTEEEVPXOATDQLDOaZHAWNXTHDXLHY I G 
76 89 85 90 95 101 

JPIVJWVAUDBAHMIHKORMLTFYZLGSOGK 
CDKYOOBVDDXCDOGRGIRMICNHSGGOPYAOYX 
KVYZWXBKOQOAZQNDTNALTCNYEHTSCT 


No 2_ 

No 3_ 

No 1_ 

No 2_ 

No 3. 

No 1_ 

No 2_ 

No 3. 


Combmation 

Total niun 

Number of comcidenoes 

Djscrep 

comparisons 

Expected 

Observed 

— 

Messages 1 and 3. 

99 

About 7 

10 


Messages 2 and 3 . 

j 97 ’ 

About 6 

6 

0 

Messages 1, 2, and 3 . .. 

293 

About 20 

25 

+25 





































Note how well the observed and expected numbers of comcidences agree m all three combma- 
tions Indeed, the results of this test are so good that the cryptanalyst imght well hesitate to 
mahe any more tests 

(5) Having ascertained the relative positions of 3 messages, the fourth message is now 
studied Here are the results tor the correct supenmposition 


s 10 IS 20 2S 30 as 

No 1- pglpnhufrksahqqaqyuozakgaeoqcnprkov 

No 2. CWHPKKXFLUMKURYXCOPHWNJUWKWIHLOK 

No 3- WFWTDNHTGMRAAZGPJDSQAUPFROXJROHRZW 

No 4- TULDHNQEZZUTYGDUEDUPSDL lOLNNB 0 NYL 

No 1- hyeiuynbonnfdmwzlukqaqahzmgcdsleagc 

No 2 .. . ZTLAWRDFGDDEZDLBOTFUZNASRHHJNGUZKPR 

No 3. CZSRTEEEVPXOATDQLDOQZHAWNXTHDXLHYIG 

No 4- QQVQGCDUTUBQXSOSKNOXUVKCYJXCNJKSANG 

« 80 88 90 98 101 

No 1- JPIVJWVAUDBAHMIHKORMLTFYZLGSOGK 

No 2- CDKYOOBVDDXCDOGRGIRM ICNHS GG 0 P YA OYX 

No 3- KVYZWXBKOQOAZQNDTNALTCNYEHTSC T 

No 4. UIFTOWOMSNBQDBAIVIKNWGVSH I E P 


C ombination 

Total num 

Number of comcideuces 


compari&ons 

Expected 

Observed 

Messages 1 and 4 

96 

About 6 

7 


Messages 2 and 4 . ... 

95 

About 6 

7 

-1-16 

Messages 3 and 4 _ 

96 

About 6 

5 

-16 

Messages 1, 2, 3, and 4 ... 

581 

About 39 

43 

+ 10 


The results for an mcorrect supenmposition (1st letter of message 4 under 4th letter of message 1) 
are also shown for companson 
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No 1_ PGLPNHUFRKSAUQQAQYUOZAKGAEOQCNPRKOV 

No 2_ CWHPKKXFLUMKURYXCOPHWNJUWKWIHLOK 

No 3_ WFWTDNHTGMRAAZGPJDSQAUPFROXJROHRZW 

No 4_ TULDHNQEZZUTYGDUEDUPSDLIOLNNBONY 

No 1_ HYEIUYNBONNFDMWZLUKQAQAHZMGCDSLEAGC 

No 2_ ZTLAWRDFGDDEZDLBOTFUZNASRHHJNGUZKPR 

No 3_ CZSRTEEEVPXOATDQLDOQZHAWNXTHDXLHY I G 

No 4_ LQQVQGCDUTUBQXSOSKNOXUVKCYJXCNJKSAN 

78 80 88 90 95 10) 

No 1_ JPIVJWVAUDBAHMIHKORMLT FYZLGS 0 GK 

No 2. CDKYOOBVDDXCDOGRGIRMI CNHSGGOPYAO YX 

No 3_ KVYZWXBKOQOAZQNDTNALT C NYEHT S C T 

No 4_ GUIFTOWOMSNBQDBAIVIKNWGVSHIEP 



(6) It IS beheved that the procedure has been explained with sufficient detail to make further 
examples unnecessary The student should bear m mmd always that as he adds messages to 
the supenmposition diagram it is necessary that he recalculate the number of comparisons so 
that the correct expected or theoretical number of comcidences will be before h i m to compare 
with the observed number In addmg messages he should see that the results of the separate 
tests are consistent, as well as those for the combmed tests, otherwise he may be led astray at 
times by the overbalancing effect of the large number of comcidences for the already ascertained, 
correct supenmpositions 

44 Subsequent steps —a In paragraph 43a four messages were given of a senes supposedly 
enciphered by a long keying sequence, and the succeeding paragraphs were devoted to an ex¬ 
planation of the preparatory steps m the solution The messages have now been properly 
superimposed, so that the text has been reduced to monoalphabetic columnar form, and the 
matter is now to be pursued to its ultimate stages 
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h The four messages employed m the demonstration of the pnnciples of the k test have 
served their purpose The mformation that they are messages enciphered by an mtelhgible 
running key, by reversed standard cipher alphabets, was withheld from the student, for peda¬ 
gogical reasons Were the key a random sequence of letters instead of mtelhgible text, the 
explanation of the comcidence test would have been unchanged m the slightest particular, so 
far as concerns the mechamcs of the text itself Were the apher alphabets unknown, mixed 
alphabets, the explanation of the k test would also have been unchanged m the slightest par¬ 
ticular But, as stated before, the four messages actually repi-esent encipherments by means of 
an mtelhgible running key, by reversed standard alphabets, they wiU now be used to illustrate 
the solution of cases of tt^ sort 

c Assummg now that the cryptanalyst is fully aware that the enemy is usmg the runmng- 
key system with reversed standarf alphabets (obsolete U S Army cipher disk), the method of 
solution outlmed m paragraph 38 will be illustrated, employmg ^e first of the four messages 
referred to above, that begmmng PGLPN HUFRK SAUQQ The word DIVISION will be taken as 
a probable word and tested agamst the key, begmmng with the very first letter of the message 
Thus 

Cipher text.. PGLPNHUFRKSAUQQ 

Assumed plain text_ DIVISION 

Besultant key text_ S 0 G X F 

The resultant key text is umntelligible and the word DIVISION is shifted one letter to the right 

Cipher text_ PGLPNHUFRKSAUQQ 

Assumed plam text_ DIVISION 

Besultant key text_ J T K . . 

Agam the resultant key text is umntelligible and the hypothetical word DIVISION is shifted 
once more Contmuation of this process to the end of the message proves that the word is not 
present Another probable word is assumed REGIMENT When the pomt shown below is 
reached, note the results 

Cipher text_ PGLPNHUFRKSAUQQ. . 

Assumed plain text_ .REGIMENT 

Besultant key text. ELANDOFT 

It certainly looks as though mtelhgible text were being obtamed as key text The words 
LAND OF T suggest that THE be tned The key letters HE give NO, making the plam text 
read REGIMENT NO The four spaces preceding REGIMENT suggest such words 

as HAVE, SEND, MOVE, THIS, etc A clue may be found by assummg that the E before LAND 
m the key is part of the word THE Testmg it on the mpW text gives IS for the plam text, 
which certam^ mdicates that the message begms with the word THIS The latter yields IN 
for the first two key letters And so on, the process of checking one text agamst the other con- 
tmuing until the entire message and the key text have been reconstructed 

d Thus far the demonstration has employed but one of the four messages available for 
solution When the reconstniction process is apphed to all four simultaneously it naturally 
goes much faster, with reduced necessity for assuming words after an imtial entering wedge has 


L 


n 


been dnven mto one message For example, note what happens m this case ]ust as soon as the 
word REGIMENT is tned m the proper place 



It IS obvious that No 2 begms with FIELD TRAIN, No 3, with ROLLING KITCHEN, No 4 
with ANTITANK GUN These words yield additional key letters, the latter suggest aditional 
plam text, and thus the process goes on until the solution is completed 

e But now suppose that the key text that has been actually employed m encipherment is 
not mtelhgible text The process is still somewhat the same, only m this case one must have at 
least two messages m the same key For instead of checking a hypothetical word (assumed to 
be present m one message) agamst the key, the same hvnd of a cheek ts made against the other 
message or messages Assume, for mstance, that m the case just descnbed the key text, mstead 
of bemg mtelhgible text, were a senes of letters produced by applying a rather complex transpo¬ 
sition to an ongmaUy mtelhgible key text Then if the word REGIMENT were assumed to be 
present m the proper place m message No 1 the resultant key letters would yield an umntelligible 
sequence But these key letters when apphed to message No 2 would nevertheless yield 
lELDTRAI, when apphed to message No 3, LINGKITC, and so on In short, the teii of one mes¬ 
sage w checked against the feat of another message or messages, if the ongmally assumed word is 
correct, then plam text will be found m the other messages ^ 

• Perhaps this is as good a place as any to make some observations which are of general interest in connection 
with the running-key principle, and which have no doubt been the subject of speculation on the part of some 
students Suppose a basic, uninteUigible, random sequence of keying characters which is not derived from the 
interaction of two or more shorter keys and which never repeats is employed hvt once as a key for encipheiment 
Can a cryptogram enciphered in such a system be solved’ The answer to this question must unqualifiedly be 
this even if the cipher alphabets are known sequences, cryptanalytic science is certainly powerless to attack 
such a cryptogram Furthermore, so far as can now be discerned, no method of attack is likely ever to be devised 
Short of methods based upon the alleged phenomena of telepathy—the very objective existence of which is 
denied by most “sane” mvestigators today—it is impossible for the present author to conceive of any way of 
attacking such a cryptogram 

This IS a case (and perhaps the only case) in which the impossibihty of cryptanalysis is mathematically 
demonstrable Two things are involved in a complete solution in mathematics not only must a satisfactory 
(logical) answer to the problem be offered, but also it must be demonstrated that the answer offered is umqw, 
that 18 , the only possible one (The mistake is often made that the latter phase of what constitutes a valid 
solution IS overlooked—and this is the basic error which numerous alleged Bacon-Shakespeare “cryptographers” 
commit) To attempt to solve a cryptogram enciphered in the manner indicated is analogous to an attempt to 
find a unique solution for a single equation containing two unknowns, with absolutely no data available for 
solution other than those given by that equation itself It is obvious that no unique solution is possible in such 
a case, since any one quantity whatsoever may be chosen for one of the unknowns and the other will follow as a 
sonsequence Therefore an mfimte number of different answers, all equally valid, is possible In the case of a 
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y All the foregoing work is, of course, based upon a knowledge of the cipher alphabets 
employed m the encipherment What if the latter are unknown sequences? It may be stated 
at once that not much could be done with but four messages, even after they had been super¬ 
imposed correctly, for the most that one would have m the way of data for the solution of the 
individual columns of text would be four letters per alphabet—^which is not nearly enough 
Data for solution by mdirect symmetry by the detection of isomorphs cannot be expected, for 
no isomorphs are produced m this system Solution can be reached only if there is sufficient 
text to permit of the analysis of the columns of the supenmposition diagram When there is 
this amoimt of text there are also repetitions which afford bases for the assumption of probable 
words Only then, and after the values of a few cipher letters have been established can mdirect 
symmetry be applied to facilitate the reconstruction of the primary components—^if used 

g Even when the volume of text is great enough so that each column contains say 15 to 20 
letters, the problem is still not an easy one But frequency distributions with 15 to 20 letters 
can usually be studied statistically, so that if two distributions present similar characteristics, 
the latter may be used as a basis for combimng distnbutions which pertam to the same cipher 
alphabet The next section will be devoted to a detailed treatment of the imphcations of the 
last statement 


cryptogram enciphered m the manner indicated, there is the equivalent of an equation with two unknowns, 
the key la one of the unknowns, the plain text is the other One may conjure up an infinite number of different 
plain texts and offer any one of them as a “solution ” One may even perform the perfectly meaningless labor 
of reconstructing the “key" for this selected “solution”, but since there is no way of proving from the cryptogram 
itself, or from the reconstructed key (which is unintelligible) whether the “solution” so selected is the actual 
plain text, all of the mfinite number of “solutions” are equally valid Now since it is inherent in the very idea 
of cryptography as a practical art that there must and can be only one actual solution (or plain text), and since 
none of this infinite number of diffeient solutions can be proved to be the one and otdy correct solution, therefoie, 
our common sense rejects them one and all, and it may be said that a cryptogram enciphered in the manner 
indicated is absolutely impossible to solve 

It 18 perhaps unnecessary to point out that the foregomg statement is no longer true when the rumung key 
constitutes mtelligible text, or if it is used to encipher more than one message, or if it is the secondary resultant of 
the interaction of two or mere short primary keys which go through cycles themselves For in these cases there 
IS additional information available for the delimitation of one of the pair of unknowns, and hence a unique solu¬ 
tion becomes possible 

Now although the runmng-key system described in the first paragiaph represents the ultimate goal of 
cryptographic security and is the ideal toward which cryptographic experts have striven for a long time, there is 
a wide abyss to be bridged between the recogmtion of a theoretically perfect system and its establishment as a 
practical means of secret intercommunication For the mere mechanical details involved m the production, 
reproduction, and distribution of such keys present difiiculties which are so fonmdable as to destroy the effective¬ 
ness of the method as a system of secret interoommumoation suitable for groups of correspondents engaged in a 
volummous exchange of messages 
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THE “CROSS-PRODUCT SUM” OR “x TEST”* 


Fsracraph 

Prelimmary remarks ..- .. 45 

The nature of the “Cross-product sum” or “x (Chi) tost” in cryptanalysis. 46 

Derivation of the x test .. 47 

Applying the * test m matching distributions--- 48 


46. Prelumuary remarks .—a The real purpose of making the comoidence test m cases such 
as that studied m the preceding section is to permit the cryptanalyst to arrange his data so as to 
ciFcumvent the obstacle which the enemy, by adoptmg a compheated polyalphabetic scheme of 
encipherment, places m the way of solution The essence of the matter is that by dealing mdi- 
vidually with the respective columns of the supenmposition diagram the cryptanalyst has 
arranged the polyalphabetic text so that it can be handled as though it were monoalphabetic 
Usually, the solution of the latter is a relatively easy matter, especially if there is sufficient text 
m the columns, or if the letters withm certain columns can be combmed mto smgle frequency 
distnbutions, or if some ciyptographic relationship can be established between the columns 

6 It IS obvious that merely ascertaining the correct relative positions of the separate mes¬ 
sages of a senes of messages m a supenmposition diagram is only a means to an end, and not an 
end m itself The purpose is, as already stated, to reduce the complex, heterogeneous, poly¬ 
alphabetic text to simple, homogeneous, monoalphabetic text But the latter can be solved only 
when there are sufficient data for the purpose—and that depends often upon the type of cipher 
alphabets mvolved The latter may be the secondary alphabets resulting from the shding of the 
normal sequence against its reverse, or a mixed component agamst the normal, and so on The 
student has enough information concerning the vanous cryptanalytic procedures which may be 
apphed, depending upon the circumstauces, m reconstructing different types of primary com¬ 
ponents and no more need be said on this score at this pomt 

c The student should, however, reahze one pomt which has thus far not been brought 
specifically to his attention Although the supenmposition diagram referred to m the precedmg 
subparagraph may be composed of many columns, there is often only a relatively small number 
of different cipher alphabets mvolved For example, m the case of two pnmary components of 
26 letters each there is a maximum of 26 secondary cipher alphabets Consequently, it follows 
that m such a case if a supenmposition diagram is composed of say 100 columns, certam of those 
columns must represent similar secondary alphabets There may, and probably wiU be, no 
regulanty of recurrence of these repeated secondanes, for they are used m a manner directly 
governed by the letters composing the words of the key text or the elements composing the 
keying sequence 

d But the latter statement offers an excellent clue It is clear that the number of times a 
given secondary alphabet is employed m such a supenmposition diagram depends upon the com- 

‘ The X test, presented in this section, as well as the $ test, presented in Section XIV, were first described 
in an important paper, Stattshecd Methodam Cryptanalyns, 1036, by Solomon Kullback, Fh D , Associate Crypt¬ 
analyst, Signal Int^gence Service I take pleasure in acknowledging my indebtedness to Dr KuUback's 
paper for the basic material used m my own exposition of these tests, as well as for his helpful criticisms thereof 
while m manuscript 
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position of the key text Smce m the case of a runmng-key system usmg a book as a key the 
key text constitutes mtelhgible text, it follows that the mnous secondary alphabets wM he em¬ 
ployed with frequencies which are directly related to the respective frequencies of occurrence of letters 
in normal plain text Thus, the alphabet corresponding to key letter E should be the most 
frequently used, the alphabet correspondmg to key letter T should be next m frequency, and so on 
From this it follows that instead of being confronted with a problem mvolying as many different 
secondary cipher alphabets as there are columns m the supenmposition diagram, the crypt¬ 
analyst usually have not over 26 such alphabets to deal with, and allowmg for the extremely 
improbable repetitive use of alphabets correspondmg to key letters J, K, Q, X, and Z, it is likely 
that the cryptanalyst will have to handle only about 19 or 20 secondary aljihabets 

e Moreover, smce the E secondary alphabet will be used most frequently and so on, it is 
possible for the cryptanalyst to study the various distributions for the columns of the super- 
imposition diagram with a view to assemblmg those distributions which belong to the same cipher 
alphabet, thus making the actual determmation of values much easier m the combmed distri¬ 
butions than would otherwise be the case 

f However, if the keying sequence does not itself constitute mtelhgible text, even if it is 
a random sequence, the case is by no means hopeless of solution—^provided there is sufficient 
text withm columns so that the columnar frequency distributions may afford mdications enabling 
the cryptanalyst to amalgamate a large number of small distnbutions mto a smaller number of 
larger distnbutions 

g In this process of assembling or combmmg mdividual frequency distnbutions which be¬ 
long to the same cipher alphabet, recourse may be had to a procedure merely alluded to m con¬ 
nection with previous problems, and designated as that of “matching” distnbutions The next 
few paragraphs wiU deal with this important subject 

46 The nature of the “Cross-product sum” or “x (Chi) test” m cryptanalysis— a The 
student has already been confronted with cases m which it was necessary or desirable to reduce 
a large number of frequency distnbutions to a smaller number by identifying and ajualgnjuatin g 
distnbutions which belong to the same cipher alphabet Thus, for example, m a case m which 
there are, say, 16 distnbutions but only, say, 5 separate cipher alphabets, the difficulty m solving 
a message can be reduced to a considerable degree provided that of the 16 distnbutions those 
which belong together can be identified and allocated to the respective cipher alphabets to which 
they apply 

b This process of identifying distnbutions which belong to the same cipher alphabet m- 
volves a careful exammation and comparison of the vanous members of the entire set of distn¬ 
butions to ascertain which of them present sufficiently similar characteristics to warrant their 
bemg combmed mto a single distnbution apphcable to one of the cipher alphabets mvolved m 
the problem Now when the mdividual distnbutions are fairly large, say containing over 60 
or 60 letters, the matter is relatively easy for the expenenced cryptanalyst and can be made by 
the eye, but when the distnbutions are small, each contammg a rather small number of letters, 
ocular comparison and identification of two or more distnbutions as belongmg to the same alpha¬ 
bet become qmte difficult and often mconclusive In any event, the fame required for the suc¬ 
cessful reduction of a multiphcity of mdividual small distnbutions to a few larger distnbutions 
18 , m such cases, a very matenal factor m determinmg whether the solution will be accomplished 
m tune to be of actual value or merely of histoncal mterest 

c However, a certain statistical test, called the “cross-product sum” or “x test”, has been 
devised, which can be brought to bear upon this question and, by methods of mathematical 
companson, ehmmate to a large degree the uncertamfaes of the ocular method of matching and 
combining frequency distnbutions, thus m many cases matenaUy reducmg the fame required 
for solution of a complex problem 
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d It IS advisable to pomt out, however, that the student must not expect too much of a 
mathematical method of comparing distnbutions, because there are limits to the size of distribu¬ 
tions to be matched below which these methods will not be effective If two distnbutions 
contain some similar charactenstics the mathematical method will merely afford a quantitative 
measure of the degree of similanty Two distnbutions may actually pertain to the same cipher 
alphabet but, as occasionally happens, they may not present any external evidences of this 
relationship, m which case no mathematical method can mdicate the fact that the two distnbu¬ 
tions are really similar and belong to the same alphabet 

47. Derivation of the x test —a Consider the followmg plain-text distnbution of 50 letters 

ABCDEFGHIJKLMNOPQRSTUVWXYZ 

In a previous text * it was shown that the chance of drawing two identical letters m normal 
TCngliah telegraphic plain text is the sum of the squares of the relative probabihties of occurrence 
of the 26 letters m such text, which is 0667 That is, the probabihty of monographic comcidence 
m TCngliah telegraphic plam text is k„= 0667 In the message to which the foregomg distnbu- 
faon of 60 letters apphes, the number of possible painngs (compansons) that can be made between 
single letters is ^^^^^ =1,225 According to the theory of comcidences there should, therefore 
be 1,226X 0667=81 7066 or approximately 82 comcidences of smgle letters Examinmg the 
distnbution it is found that there are 83 comcidences, as shown below 

ABCDEFGHIJKLMNOPQRSTUVWXYZ 

3 + 0 + 0 + 1+21+0 + 0 + 1 + 3 + 0 + 0 + 0 + 1+10+IS+0+0 + 1+10+15+1 + 0 + 1+0 + 0+ 0-83 

The actual number of comcidences agrees very closely with the theoretical number, which is 
of course to be expected, smce the text to which the distnbution apphed has been mdicated as 
being normal plam text 

6 In the foregoing simple demonstration, let the number of compansons that can be made 
m the distnbution be mdicated symbolically by —W’here iV=the total number of letters 

in the distnbution Then the expected number of comcidences may be written as 
which may then be rewntten as 

0067iV*- 0667iV 

(i; 2 


c Likewise, if/* represents the number of occurrences of A m the foregomg distribution, 
then the number of comcidences for the letter A may be mdicated symbohcally 

And similarly, the number of comcidences for the letter B may be mdicated by 
so on down to fz(fz—l) The total number of actual comcidences foimd m the distnbution is, 
2 

^ r/AC/li—1) ,/b(/'b—1) , fzifr—^) If the symbol/e IS used to indicate 

of course, the sum of —^+-^2—"^2 - 

any of the letters A, B, Z, and the symbol S is used to indicate that the ^um of all the 


* Military Cryptanalyns, Part II, Appendix 2 
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elements that follow this sign is to be found, then the sum of the actual comcidences noted in 
the distribution may be indicated thus which may be rewritten as 


(n) 

d Now although denved from different sources, the two expressions labeled (I) and (II) 
above are equal, or should be equal, m normal plam text Therefore, one may wnte 

V/ 0 *-/ 0 _ 0667iV»- 0667iV 

Zj 2 ~ 2 

Simphfymg this equation 

(III) S/ 0 »- 2 / 0 = 06671V*- 06671V 

e Now 'Zfa—N 

Therefore, expression (III) may be wntten as 

(IV) S/ 0 *-lV= 0667N*- 06671V, 

which on reduction becomes 

(V) 2 / 0 *= 06671V*+ 93331V 

This equation may be read as “the sum of the squares of the absolute frequencies of a distribution 
IS equal to 0667 tunes the square of the total number of letters m the distribution, plus 9333 
times the total number of letters in the distnbution ” The letter S 2 is often used to replace the 
symbol 2 / 0 * 

/ Suppose two monoalphabetic distributions are thought to pertam to the s.ime cipher 
alphabet Now if they actually do belong to the same alphabet, and if they are correctly* 
combined into a single distribution, the latter must still be monoalphabetic m character That 
IS, again representing the mdividual letter frequencies in one of these distributions by the general 
symbol /oj the mdividual letter frequencies m the other distnbution by/ 0 j, and the total frequency 
m the first distnbution by Ni, that in the second distnbution by Na, then 

(VI) S(/ 0 i+/e*)*= 0667(Ar,+iV,)*+ 9333(iV,+Nj) 


Expanding the terms of this equation 

(VII) 2/0,*+22/ej0,+2/0,*= 0667(JV,*+2MiV,+Wl+ 9333iV,+ 9333iV, 
But from equation (V) 

2 / 0 ,*= 0667Ni*+ 9333M and 


sy0j*= 0667iV,*+ 9333iV2, 


so that equation (VII) may be rewritten thus 

0667iV,*+ 9333iVi+22/0,/0,+ 0667iV,*+ 9333iV2= 

0667(M*+2iV,iV3+iV,*)+ 9333iV,+ 9333iVs 


* By “correctly” is meant that the two distributions are shd relative to each other to their proper super- 
imposition 


Reducing to simplest terms by cancelling out Himilwr expressions 
2 Syo,/o»= 0m(2NiNa), or 

(vni) ^- 066 ? 

g The last eqyatum thus permits of establishing an expected value for the sum of the products 
of the corresponding frequencies of the two distributions being considered for amalgamaiion The 
cross-product sum or x test for matching two distributions is based upon equation (F///) 

48 Applymg the x test in matching distributions —a Suppose the following two distribu¬ 
tions are to be matched 


/t. ABCDEFGHIJKLMNOPQRSTUVWXYZ 

/*.- ABCDEFGHIJKLMNOPQRSTUVWXYZ 

Let the frequencies be juxtaposed, for convenience m findmg the sum of the cross products 
Thus- 

/®». 14030100100100100322101302 iVi=26 

ABCDEFGHIJKLMNOPQRSTUVWXYZ 

.. 02000300101001100311000012 

/oi/ea. 08000300100000100922000004 


In this case 2 y 0 ,/ 0 ,= 8 -f- 3 -l- 14 •l^- 9 -f- 2 -^ 2 -^- 4 = 3 O 


AT,AT,=26X17=442 


yejet __ 30 
NiNa 422 


== 0711 


b The fact that the quotient (0711) agrees very closely with the expected value (0667) 
means that the two distnbutions very probably belong together or are properly matched Note 
the quahfjnng phrase “very probably ” It imphes that there is no certainty about t.hia busmess 
of matching distributions by mathematical methods The mathematics serve only as measuring 
devices, so to speak, which can be employed to measure the degree of similanty that exists 

c Instead of dividmg "Sfaja^ by N^Na and seeing how closely the quotient approximates the 
value 0667 or 0385, one may set up an expected value for Z/©,/©, and compare it with the ob¬ 
served value Thus, m the foregoing example 0667 (MA7i)= 0667X422=28 16, the observed 
value of ^foiifoa w 30 and therefore the agreement between the expected and the observed values 
IS qmte close, mdicatmg that the two distributions are probably properly matched 

d There are other mathematical or statistical tests for matchmg, m addition to the x test 
Moreover, it is possible to go further with the x test and find a measure of the rehance that may 
be placed upon the value obtained, but these points will be left for future discussion m subse¬ 
quent texts 


135922—39-6 
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e One more pomt will, however, here be added m connection with the x test Suppose 
the very same two distnbutions m subparagraph a are agam juxtaposed, but with shifted one 
mterval to the left of the position shown m the subparagraph of reference Thus 

. (14030100100100100322101302 i\r,=26 

■'®‘.I ABCDEFGHIJKLMNOPQRSTUVWXYZ 

^ JbCDEFGHIJKLMNOPQRSTUVWXYZA iVa=17 

■'®*‘.12 0003001010011003110000120 


Here S/e,/ej=2+3+2+3=10 


2/e,y9a_ 10 _ 
iV,F,'“442~ 


The observed ratio (0226) is so much smaller than the expected (0667) that it can be said that if 
the two distributions pertam to the same primary components they are not properly superimposed 
In other words, the x test may also be applied in cases where two or more frequency distributions must 
be shifted relaiively in order to find their correct supenmposihon The Iheory underlymg this apph- 
cation of the x test is, of course, the same as before two monoaJphabetic distributions when prop¬ 
erly combmed will yield a smgle distnbution which should still be monoalphabetic m character 
In applying the x test m such cases it may be necessary to shift two 26-element distributions to 
various supenmpositions, make the x test for each supenmposition, and take as correct that one 
which yields the best value for the test 

y The nature of the problem will, of course, determme whether the frequency distributions 
which are to be matched should be compared (1) by direct supenmposition, that is, setting the A 
to Z talhes of one distnbution directly opposite the correspondmg talhes of the other distnbution, 
as m subparagraph a, or (2) by shifted supenmposition, that is, keeping the A to Z talhes of the 
first distnbution fixed and shding the whole sequence of talhes of the second distnbution to 
vanous supenmpositions agamst the first 
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Section XIII 

APPLYING THE CROSS-PEODUCT OR x TEST 


Paraoraph 

Study of a situation in which the % test may be applied. 49 

Solution of a piogressive-alphabet system bv means of the x test- 50 

Alternative method of solution . 61 


49 Study of a situation m which the x test may be apphed — a A simple demonstration 
of how the x-test is apphed m matching frequency distnbutions may now be set before the 
student The problem mvolved is the solution of cryptograms enciphered accordmg to the 
progressive-alphabet system (par 366), with secondary alphabets denved from the mteraction 
of two identical mixed primary components It will be assumed that the enemy has been usmg 
a system of this kind and that the pnmaiy components are changed daily 

b Before attacking an actual problem of this type, suppose a few mmutes be devoted to a 
general analysis of its elements It is here assumed that the primary components are based 
upon the HYDRAULIC Z sequence and that the cipher component is shifted toward the 

right one step at a tune Consider a cipher square such as that shown m Figure 12, which is 
apphcable to the type of problem under study It has been arranged m the form of a deciphering 
square In this square, the horizontal sequences are all identical but merely shifted relatively, the 
letters inside the square are plain-text letters 
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Alphablt No 



12 13 14 18 It 17 18 19 20 21 22 23 24 25 26 


A AULICBEFGJKMNOPQSTVWXZHYDR 
B BEFGJKMNOPQSTVWXZHYDRAULIC 
C CBEFGJKMNOPQSTVWXZHYDRAULI 
D DRAULICBEFGJKMNOPQSTVWXZHY 
E EFGJKMNOPQSTVWXZHXDRAULICB 
F FGJKMNOPQSTVWXZHYDRAULICBE 
G GJKMNOPQSTVWXZHYDRAULICBEF 
H HYDRAULICBEFGJKMNOPQSTVWXZ 
I ICBEFGJKMNOPQSTVWXZHYDRAUL 
J JKMNOPQSTVWXZHYDRAULICBEFG 
K KMNOPQSTVWXZHYDRAULICBEFGJ 
L LICBEFGJKMNOPQSTVWXZHYDRAU 
M MNOPQSTVWXZHYDRAULICBEFGJK 
N NOPQSTVWXZHYDRAULICBEFGJKM 
0 OPQSTVWXZHYDRAULICBEFGJKMN 
P PQSTVWXZHYDRAULICBEFGJKMNO 
Q QSTVWXZHYDRAULICBEFGJKMNOP 
R RAULICBEFGJKMNOPQSTVWXZHYD 
S STVWXZHYDRAULICBEFGJKMNOPQ 
T TVWXZHYDRAULICBEFGJKMNOPQS 
U ULICBEFGJKMNOPQSTVWXZHYDRA 

V VWXZHYDRAULICBEFGJKMNOPQST 
W WXZHYDRAULICBEFGJKMNOPQSTV 
X XZHYDRAULICBEFGJKMNOPQSTVW 

Y YDRAULICBEFGJKMNOPQSTVWXZH 
Z ZHYDRAULICBEFGJKMNOPQSTVWX 


[Flam text letters are within the square proper] 


c If, for mere purposes of demonstration, mstead of letters within the cells of the square 
there are placed tallies corresponding m number with the normal frequencies of the letters 
occupymg the respective cells, the cipher square becomes as follows (showing only the 1st 
three rows of the square) 


Alphabet No 


1 2 3 4 5 a 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 28 26 
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§ 



Figubi 13a 


d It IS obvious that here is a case wherein if two distributions pertaining to the square are 
isolated from the square, the x test (matching distributions) can be applied to ascertain how the 
distnbutions should be slufted relative to each other so that they tan be supeiimposed and made 
to yield a monoalphabetic composite There is obviously one correct superimpositioii out of 25 
possibilities In this case, the B row of tallies must be displaced 6 intervals to the light in order 
to match it and amalgamate it with the A row of tallies Thus 


A 

^1 

^2 

^3 

^4 

^6 


1 

7 

% 


10 

11 

^2 

13 

14 

"15 


^7 

4 

- 



22 


^^4 

'^5 


B 

i 



^6 

le 

"i 

S 

5_ 



5 

6 

3-^ 




11 

12 

n 

"14 


IG 


'18 

'lO 


Jl 


FiruBX 135 


e Note that the amount of displacement, that is, the number of intervals the B sequence 
must be slufted to make it match the A sequence in Figure 136, corresponds exactly to the distance 
between the letters A and B m the primary cipher component, which is 5 intervals Thus 

0 1 2 3 4 5 

A U L I C B The fact that the primary plain component is in this case identical 

with the primary cipher component has nothing to do with the matter The d%splacement ^nteroal 
IS bevng measured on the nyhei component It is important that the student see this point very 
clearly He can, if he like, pro\ e the point by expennientmg with two different primary com¬ 
ponents 

i Assuming that a message in such a system is to be solved, the text is transcribed m rows 
of 26 letters A uniliteral frequency distnbution is made for each column of the transcribed 
text, the 26 separate distributions being compiled within a smgle square such as that shown m 
Figure 14 Such a square may be termed & frequency distribution square 

g Now the vertical columns of tallies within such a distnbution square constitute frequency 
distnbutions of the usual type They show the distnbution of the vanous cipher letters m each 
cipher alphabet If there were many lines of text, all arranged m penods of 26 letters, then each 
column of the frequency square could be solved in the usual manner, by the application of the 
simple prmciples of monoalphabetic frequency But what do the horizontal rows of tallies 
withm the square represent? Is it not clear that the first such row, the A row, merely shows the 
distribution of Ac throughout the successive cipher alphabets? And does not this graphic picture 
of the distribution of A* correspond to the sequence of letters composing the primary plain component t 
Furthermore, is it not clear that what has been said of the A row of tallies applies equally to the 
B, C, D, Z rows? Fmally, is it not clear that the graphic pictures of all the distnbutions 
correspond to the same sequence of letters, except that the sequence begins with a different letter 
m each row? In other words, all the horizontal rows of tallies within the distribution square 
apply to the same sequence of plam-text letters, the sequences m one row merely begmnmg with 
a different letter from that with which another row begms The sequences of letters to which 
the tallies apply in the various rows are merely displaced relative to one another Now if there 
are sufficient data for statistical purposes in the vanous honzontal sequences of tallies w'lthin the 
distnbution square, these sequences, being approximately similai, can be studied by means of 
the X f®st to find their relative displacements And m finding the latter a method is piovided 
whereby the pnmary cipher component may be reconstructed, since the correct assembling of 
the displacement data wnll yield the sequence of letters constituting the primary cipher component 
If the plain component is identical with the cipher component, the solution is immediately a< 
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hand, if they are different, the solution is but one step removed Thus, there has been elabo¬ 
rated a method of solving this type of cipher system wvthovi making any assumptions oj values 
for cipher letters 

60 Solution of a progressive-alphabet system by means of the x test —a The followmg 
cryptogram has been enciphered accordmg to the method indicated, by progressive, simple, 
unmterrupted shiftmg of a pnmary cipher component against an identical pnmaiy plain 
component 

Cbtptogeam 

WGJJM MMJXE DGCOC FTRPB MIIIK ZRYNN 
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b The message is transcnbed m Imes of 26 letters, smce that is the total number of secondary 
alphabets m the system The transcnbed text is sliown below 

1 a S 4 t » 7 8 » 10 11 la 18 14 15 1« 17 Ig IB » 21 22 23 84 25 a» 

1 WGJJMMMJXEDGCOCFTRPBMIIIKZ 

2 R y N N B U F R ff W W W y 0 I H F J K 0 K H T T A Z 

3 C L J E P P F R W C K 0 0 F F F G E P Q R y y I W X 

4 M X U D I P F E X M L L W F K G Y P B B X C H B F y 

6 lETXHFBIVDIPNXIVRPWTMGIMPT 

6 ECJBOKVBUQGVGFFFKLYYCKBIWX 

7 MXUDIPFFUYNVSSIHRMHYZHAUQW 

8 GKTIUXYJJAOWZOCFTRPPOQUSGY 

9 CXVCXUCJLMLLYEKFFZVQJQSIYS 

10 PDSBBJUAHYNWLOCXSDQVCYVSIL 

11 IWNJOOMAQSLWYJGTVPQKPKTLHS 

12 ROONICFEVMNVWNBNEHAMRCROVS 

13 TXENHPVBTWKUQIOCAVWBRQNFJV 

14 NRVDOPUQRLKQNFFFZPHURVWLXG 

15 SHQWHPJBCNNJQSOQORCBHRRAON 

16 RKWUHYYCIWDGSJCTGPGRMIQMPS 

17 GCTNMFGJXEDGCOPTGPWQQVQIWX 

18 TTTCOJVAAABWMXIHOWHDEQUAIN 

19 FKFWHPJAHZITWZKFEXSRUYQIOV 

20 RERDJVDKHIRQWEDGEBYBMLABJV 

21 TGFFGXYIVGRJYEKFBEPBJOUAHC 

22 UGZLXIAJKWDVTYBFRUCCCUZZIN 

23 NDFRJFMBHQLXHMHQYYYMWQVCLI 

24 PTWTJYQBYRLITUOUSRCDCVWDGI 

25 GGUBHJVVPWABUJKNFPFYWVQZQF 

26 LHTWJPDRXZOWUSSGAMHNCWHSWW 

27 LRYQQUSZVDNXANVNKHFUCVVSSS 

28 PLQUPCVVVWDGSJOGTCHDEVQSIJ 

29 PHQJAWFRIZDWXXHCXYCTMGUSES 

30 NDSBBKRLVWRVZEEPPPATOIANEE 

31 EEJNRCZBTBLXPJJKAPPMJEGIKR 

32 TGFFHPVVVYKJEFHQSXJQDYVZGR 

33 RHZQLYXKXAZOWRRXYKYGMGZBYN 

34 VHQBRVFEFQLLWZEYLJEROQSOQK 

35 OMWIOGMBKFFLXDXTLWILPQSEDY 

36 lOEMOIBJMLNNSYKXJZJMLCZBMS 

37 DJWQXTJVLFIRNRXHYBDBJUFIRJ 

38 ICTUUUSKKWDVMFWTTJKCKCGCVS 

39 AGQBCJMEBYNVSSJKSDCBDYFPPV 

40 FDWZMTBPVTTCGBVTZKHQDDRMEZ 

41 0 0 
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d The X test will now be apphed to the honzontal rows of talhes in the distnbution square, 
accordance with the theory set forth in paragraph 49^ Since this test is purely statistical 
character and becomes increasmgly reliable as the size of the distnbutions increases, it is best 
start by working with the two distributions having the greatest total numbers of talhes 
These are the V and W distnbutions, with 53 and 52 occurrences, respectively The results of 
three relative displacements of these two distnbutions are shown below, labeled “First test,” 
“Second test,” and “Third test ” 

Fikbt Test 


J 10200264 
^*1 12346678 

124 25 26 I 2 3 4 5 

■''^ 0 4 2 1 1 5 3 0 

frfw 0 0 4 0 0 10 18 0 


800700211111064024 
9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 

6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 
100281760100230212 

800 14 00 14 601000 18 0028 


T^vfw _ 103 
NrNw~27bb 


037 


Nw=52 


2fvfw=lQ5 


Second Test 


,ri0200264800700211111064024 
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 

, fl8 19 20 21 22 23 24 25 26 1 2 3 4 5 6 6 8 9 10 11 12 13 14 15 16 17 
•^’'1 23021204211530100281760100 
fyf, 2000040 16 16 00 35 0020028 1 0 36 000 0 


Sfr/fT 122. 

ffrATtr 2756' 


044 


Ny = 53 

N,y=52 

Xfvfw=l22 


Third Test 




1 0 
1 2 


0 

4 


0264800700211111064024 
6 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 




4 6 
3 0 


7 

0 


8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 1 2 3 
0281760100230212042115 


Nv=5Z 

Nw-= 52 


frfw 3 0 


2004 48 4 56 007004302120 24 802 20 


r/v/s'^lOO 


e Smce the last of the three foregoing tests gives a value somewhat better than the expected 
0667, It looks as though the correct position of the W distnbution with reference to the V distnbu¬ 
tion has been found In practice, several more tests would be made to insure that other close 
approximations to 0667 will not be found, but these will here be omitted The t^t^in^cates 

that the pnmary cipher component has the letters V and W in these positions V W, smce 
the correct superunposition requires that the 4th cell of the W distnbution must be placed imder 
the let cell of the V distnbution (see the last supenmposition above) 

/ The next best distnbution with which to proceed is the P distnbution, with 51 occurrences 
Parallehng the procedure outlined in paragraph 43, and for the same reasons, the F sequence 
is matched agamst the W and V sequences separately and then against both W and V sequences 









at their correct supenmposition The following shows the correct relative positions of the three 
distnbutions 

0200264800700211111064024 iVr=53 
2 3 4 5 6 7 8 9 10 11 12 13 14 16 16 17 18 19 20 21 22 23 24 25 26 

. f8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 26 26 1 2 3 4 5 6 7 
■'"U 1210063930200021112042037 Ar,= 61 
frfF 104000 36 12 72 00 14 00021 1 120 24 806 28 2/r/jF=212 


6 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 
9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 26 26 1 2 3 4 


fwfr 03 35 302000 48 3 63 18 02000602 


2 0 4 2 JV,= 51 
4 0 16 4 2/,p/,=210 


,/ 03004 14 6 16 608004413230 10 6139 Ar,+Br=106 

2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 

f8 9 10 11 12 13 14 16 16 17 18 19 20 21 22 23 24 25 26 1 2 3 4 6 6 7 

■''■[1 1210063930200021112042037 JV,= 51 
fir+w)fFi 0 6 0 0 0 84 15 35 18 0 16 0 0 0 8 1 3 2 6 0 40 12 0 9 63 2/(r+ir)/F=422 

S/cf+th/f 422 
Nir+w)NF 6 , 355 “°^® 

1 2 S 4 S « 7 8 

The test yields the sequence V ff F 

g The process is continued in the foregoing manner until the entire primary cipher com¬ 
ponent has been reconstructed It is obvious that as the work progresses the cryptanalyst is 
forced to employ smaller and smaller distributions, so that statistically the results are apt to 
become less and less certain But to counterbalance this there is the fact that the number of 
possible supenmpositions becomes progressively smaller as the work progresses For example, 
at the commencement of operations the number of possible points for superimposing a second 
sequence agamst the first is 25, after the relative positions of 5 distributions have been ascer- 
tamed and a 6th distnbution is to be placed in the primary sequence bemg reconstructed, there 
are 21 possible positions, after the relative positions of 20 distributions have been ascertained, 
there are only 6 possible positions for the 21st distnbution, and so on 

h In the foregoing case the completely reconstructed pnmary cipher component is as 
follows 

1 2 3 4 S « 7 8 2 10 11 12 13 14 IS 16 17 18 18 20 21 22 23 24 26 28 

VALWNOXFBPYRCQZIGSEHTDJUMK 

Since it was stated that the problem involves identical pnmary components, both components 
are now at hand 


87 


t Of course, it is probable that in practical work the process of matching distnbutions 
would be mterrupted soon after the positions of only a few letters m the pnmary component had 
been ascertamed For by trying partially reconstructed sequences on the cipher text the skele¬ 
tons of some words would begin to show By filhng m these skeletons with the words suggested 
by them, the process of reconstructing the components is much facihtated and hastened 

3 The components havmg been reconstructed, only a moment or two is necessary to as- 
certam their mitial position in enciphering the message It is only necessary to juxtapose the 
two components so as to give “good” values for any one of the vertical distributions of Figure 14 
This then gives the juxtaposition of the components for that column, and the rest follows very 
easdy for the plam text may now be obtamed by direct use of the components The plain text 
of the message is as follows 

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 

1 WGJJMMMJXEDGCOCFTRPBMIIIKZ 
WITHTHEIMPROVEMENTSINTHEAI 

2 RYNNBUFRWWWWYOIHFJKOKHTTAZ 
RPLANEANDTHEMEANSOFCOMMUNI 

3 CLJEPPFRWCKOOFFFGEPQRYYIWX 
CATIONANDWITHTHEVASTSIZEOF 

4 MXUDIPFEXMLLWFKGYPBBXCHBFY 
MODERNARMIESSTRATEGICSURPR 

5 lETXHFBIVDIPNXIVRPWTMGIMPT 
ISEWILLBECOMEHARDERANDHARD 

6 ECJBOKVBUQGVGFFFKLYYCKBIWX 
ERTOATTAINXINTHEPRESENCEOF 

7 MXUDIPFFUYNVSSIHRMHYZHAUQW 
MODERNAVIATIONANDFASTMOVIN 

8 GKTIUXYJJAOWZOCFTRPPOQUSGY 
GMECHANIZEDELEMENTSGREATER 

9 CXVCXUCJLMLLYEKFFZVQJQSIYS 
COMPLEXITIESMORESUBTLEDECE 

10 PDSBBJUAHYNWLOCXSDQVCYVSIL 
PTIONSSTRATEGEMSANDFEINTSW 

11 IWNJOOMAQSLWYJGTVPQKPKTLHS 
ILLHAVETOBEEMPLOYEDXINMODE 

12 ROONICFEVMNVWNBNEHAMRCROVS 
RNWARFAREITISSTILLPOSSIBLE 

13 TXENHPVBTWKUQIOCAVWBRQNFJV 
TOGAINTACTICALSURPRISEBYMA 

14 NRVDOPUQRLKQNFFFZPHURVWLXG 
NYMEANSXWHILETHEMEANSOFOBS 

15 SHQWHPJBCNNJQSOQORCBMRRAON 
SERVINGANDTRANSMITTINGINFO 



16 

17 

18 

19 

20 
21 
22 

23 

24 

25 

26 

27 

28 

29 

30 

31 
23 

33 

34 


RKWUHYYCI 

RMATIONOF 

GCTNMFGJX 

GREATLYIM 

TTTCOJVAA 

THEPASTTH 

FKFWHPJAH 

FMOVINGTR 

RERDJVDKH 

RSPEEDIER 

TGFFGXYIV 

TIONCANBE 

UGZLXIAJK 

UICKLYDIS 

NDFRJFMBH 

NTOBELEAR 

PTWTJYQBY 

PHASEOFAL 

GGUBHJVVP 

GIDOISTHA 

LHTWJPDRX 

LEEVENINM 

LRYQQUSZV 

LYBYPERFE 

PLQUPCVVV 

PARTOFTHE 

PHQJAWFRI 

PERHUMANF 

NDSBBKRLV 

NTIONTODE 

EEJNRCZBT 

ESTAFFBAC 

TGFFHPVVV 

TIONINTHE 

RHZQLYXKX 

RECYMOVEM 

VHQBRVFEF 

VEROFDARK 

OMWIOGMBK 

OUACAREAS 


WDGSJCTG 

TROOPMOV 

EDGCOPTG 

PROVEDOV 

ABWMXIHO 

EMECHANI 

ZITWZKFE 

OOPSAREL 

IRQWEDGE 

XALSOFAL 

GRJYEKFB 

FARMOREE 

WDVTYBFR 

TRIBUTED 

QLXHMHQY 

NEDFROMT 

RLITUOUS 

LENBYSBA 

WABUJKNF 

TSURPRIS 

ZOWUSSGA 

ODERNWAR 

DNXANVNK 

CTDISCIP 

WDGSJOGT 

TROOPSAN 

ZDWXXHCX 

ORETHOUG 

WRVZEEPP 

TAILONTH 

BLXPJJKA 

KEDUPBYR 

YKJEFHQS 

AIRXTOMA 

AZOWRRXY 

ENTSMUST 

QLLWZEYL 

NESSANDC 

FFLXDXTL 

MUSTBEOC 


PGRMIQMPS 

EMENTSARE 

PWQQVQIWX 

ERTHOSEOF 

WHDEQUAIN 

CALMEANSO 

XSRUYQIOV 

IKEWISEFA 

BYBMLABJV 

SEINFORMA 

EPBJOUAHC 

ASILYANDQ 

UCCCUZZIN 

XTHELESSO 

YYMWQVCLI 

REOPENING 

RCDCVWDGI 

TTLEOFMEG 

PFYWVQZQF 

EISPOSSIB 

MHNCWHSWW 

FAREBUTON 

HFUCVVSSS 

LINEONTHE 

CHDEVQSIJ 

DALMOSTSU 

YCTMGUSES 

HTANDATTE 

PATOIANEE 

EPARTOFTH 

PPMJEGIKR 

ESOLUTEAC 

XJQDYVZGR 

INTAINSEC 

KYGMGZBYN 

BEUNDERCO 

JEROQSOQK 

OVEREDBIV 

WILPQSEDY 

CUPIEDDUR 


35 
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1 2 3 4 5 6 7 8 9 10 11 12 n 14 IS 16 17 18 19 20 21 22 23 24 25 26 

36 lOEMOIBJMLNNSYKXJZJMLCZBMS 
INGDAYLIGHTHOURSXUNOBSERVE 

37 DJWQXTJVLFIRNRXHYBDBJUFIRJ 
DDAYLIGHTMOVEMENTSWILLREQU 

38 ICTUUUSKKWDVMFWTTJKCKCGCVS 
IRETHERESTRICTIONOFHOSTILE 

39 AGQBCJMEBYNVSSJKSDCBDYFPPV 
AIROBSERVATIONBYANTIAIRCRA 

40 FDWZMTBPVTTCGBVTZKHQDDRMEZ 
FTARTILLERYANDCOMBATAVIATI 

41 0 0 
0 N 

WITH THE IMPROVEMENTS IN THE AIRPLANE AND THE MEANS OF COMMUNICATION AND WITH 
THE VAST SIZE OF MODERN ARMIES STRATEGIC SURPRISE WILL BECOME HARDER AND 
HARDER TO ATTAIN X IN THE PRESENCE OF MODERN AVIATION AND FAST MOVING MECHANIZED 
ELEMENTS GREATER COMPLEXITIES MORE SUBTLE DECEPTIONS STRATEGEMS AND FEINTS 
WILL HAVE TO BE EMPLOYED X IN MODERN WARFARE IT IS STILL POSSIBLE TO GAIN 
TACTICAL SURPRISE BY MANY MEANS X WHILE THE MEANS OF OBSERVING AND TRANSMITTING 
INFORMATION OF TROOP MOVEMENTS ARE GREATLY IMPROVED OVER THOSE OF THE PAST THE 
MECHANICAL MEANS OF MOVING TROOPS ARE LIKEWISE FAR SPEEDIER X ALSO FALSE 
INFORMATION CAN BE FAR MORE EASILY AND QUICKLY DISTRIBUTED X THE LESSON TO BE 
LEARNED FROM THE OPENING PHASE OF ALLENBYS BATTLE OF MEGGIDO IS THAT SURPRISE IS 
POSSIBLE EVEN IN MODERN WARFARE BUT ONLY BY PERFECT DISCIPLINE ON THE PART OF THE 
TROOPS AND ALMOST SUPERHUMAN FORETHOUGHT AND ATTENTION TO DETAIL ON THE PART OF 
THE STAFF BACKED UP BY RESOLUTE ACTION IN THE AIR X TO MAINTAIN SECRECY MOVE¬ 
MENTS MUST BE UNDER COVER OF DARKNESS AND COVERED BIVOUAC AREAS MUST BE OCCUPIED 
DURING DAYLIGHT HOURS X UNOBSERVED DAYLIGHT MOVEMENTS WILL REQUIRE THE RESTRIC¬ 
TION OF HOSTILE AIR OBSERVATION BY ANTIAIRCRAFT ARTILLERY AND COMBAT AVIATION 

k The student should clearly understand the real nature of the matching process employed 
to such good advantage m this problem In practically all the previous cases frequency distn- 
butions were made of cipher letters occurring m a cryptogram, and the talhes m those distribu¬ 
tions represented the actual occurrences of cipher letters Furthermore, when these distribu¬ 
tions were compared or matched, what were bemg compared were actually cipher alphabets 
That IS, the text was arranged m a certain way, so that letters belongmg to the same cipher alphabet 
actually fell withm the same column and the frequency distnbution for a specific cipher alphabet 
was made by tabulating the letters in that column Then if any distributions were to be com¬ 
pared, usuaUy the entire distribution apphcable to one cipher alphabet was compared with the 
entire distribution applymg to another cipher alphabet But m the problem ]ust completed, 
what were compared m reahty were not frequency distributions applying to the columns of the 
cipher text as transcnbed on p 83, but graphic representations of the variations m the frequencies 
of plain-text letters jailing in identical sequences, the identities oj these plaivrtext letters being 
unknown jor the moment Only after the reconstruction has been completed do their identities 
become known, when the plam text of the eryptogram is established 
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61 Alternative method of solution —a The foregoing method of solution is, of course, 
almost entirely statistical m nature There is, however, another method of attack which should 
be brought to notice because m some cases the statistical method, mvolvmg the study of rela¬ 
tively large distnbutions, may not be feasible for lack of sufficient text Yet m these cases there 
may be sufficient data m the respective alphabets to permit of some assumptions of values of 
cipher letters, or there may be good grounds for applying the probable-word method The 
present paragraph will therefore deal with a method of solving progressive cipher systems which 
IS based upon the apphcation of the principles of indirect symmetry to certam phenomena ansing 
from the mechanics of the progressive encipheiment method itself 

b Take the two sequences below and encipher the phrase FIRST BATTALION by the pro¬ 
gressive method, shding the cipher component to the left one mterval after each encipherment 

Components 

Plain...__ HYDRAULICBEFGJKMNOPQSTVWXZ 

Cipher__ FBPYRCQZIGSEHTDJUMKVALWNOX 

Message 

1 2 3 4 6 6 7 8 9 10 11 12 13 14 

Plain...__ FIRSTBATTALION 

Cipher.... EICNXDSPYTUKYY 

c Certain letters are repeated m both plain text and cipher text Consider the former 
There are two I’s, three T’s, and two A’s Their encipherments are isolated below, for con- 
vemence m study 

FIRSTBATTALION 

1 2 8 4 6 6 7 8 9 10 11 12 13 14 

Plam. I I (1) 

Cipher. __I _ K (2) 

Plam. T T T (3) 

Cipher... X P Y _ (4) 

Plain... A A (5) 

Cipher-- -S_T_ (6) 

The two I’s in hne (1) are 10 letters apart, reference to the cipher component will show that the 
mterval between the cipher equivalent of the first Ip (which happens to be I,) and the second Ip 
(which IS Ko) 18 10 Consideration of the mechamcs of the enciphenng system soon shows why 
this is so: since the cipher component is displaced one step with each encipherment, two identical 
letters n mtervals apart m the plam text must yield cipher eqmvalents which are n intervals 
apart m the cipher component Exammation of the data m hnes (3) and (4), (6) and (6) will 
confirm this findmg Consequently, it would appear that in such a system the successful apph¬ 
cation of the probable-word method of attack, coupled withm mdirect symmetry, can qmckly 
lead to the reconstruction of the cipher component 
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d Now consider the repeated cipher letters m the example under b There happens to be 
only two cases of repetition, both mvolvmg Y's Thus 

1 2 3 4 S e 7 8 9 10 11 12 13 14 

T ON 

Y . Y Y 

Reference to the plam component will show that the plain-text letters represented by the three 
Y’s appear in the order NO T, that is, reversed with respect to their order m the plam text 

But the mtervals between these letters is correct Again a consideration of the mechamcs of 
the enciphenng system shows why this is so smce the cipher component is displaced one step 
with each encipherment, two identical letters n mtervals apart m the cipher text must represent 
plam-text letters which are n mtervals apart m the plam component In the present case the 
direction m which these letters run m the plain component is opposite to that m which the 
cipher component is displaced That is, if the cipher component is displaced toward the left, 
the values obtamed from a study of repeated plam-text letters give letters which comcide m 
sequence (mterval and direction) with the same letters m the cipher component, the values 
obtamed from a study of repeated cipher-text letters give letters the order of which must be 
reversed m order to make these letters comcide m sequence (mterval and direction) with the 
same letters m the plam component If the cipher component is displaced toward the right, this 
relationship is merely reversed the values obtamed from a study of the repeated plam-text 
letters must be reversed m their order when placmg them m the cipher component, those yielded 
by a study of the repeated cipher-text letters are mserted in the plam component m their original 
order 

e Of course, if the primary components are identical sequences the data from the two 
sources referred to m subparagraphs c and d need not be kept separate but can be combmed 
and made to yield the primary component very qmckly 

y With the foregoing prmciples as background, and given the followmg message, which is 
assumed to begm with COMMANDING GENERAL FIRST ARMY (probable-word method of attack), 
the data yielded by this assumed text are shown m Figure 15 

Message 

IKMKI LIDOL WLPNM VWPXW DUFFT 

FNIIG XGAMX CADUV AZVIS YNUNLetc,etc 

1 2 3 4 3 6 7 8 9 10 11 12 13 14 16 16 17 18 19 20 21 22 23 24 25 2« 

Assumed plam text COMMANDINGGENERALFIRSTARMY 
Cipher. IKMKILIDOLWLPNMVWPXWDUFFTF 
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Figure 15 


Analysis of the data afforded by Figure 15, m conjunction with the principles of indirect sym¬ 
metry, yields the following partial components 


Plam_ 

Cipher_ 


14 5 

Lie 
M K V 


7 8 9 10 11 12 13 14 IS 16 17 18 19 20 21 22 23 24 25 28 

EFG MNO S YDR 

LWNOFP I T 

X 


Settmg the two partial components mto juxtaposition so that Cp=Ic (first encipherment) the 
8th value, Ip=Dc, gives the position of D in the cipher component and permits the addition of X 
to it, these bemg two letters which until now could not be placed mto position m the apher 
component With these two partial sequences it becomes possible now to decipher many other 


letters m the message, gaps bemg filled m from the context For example, the first few letters 
after ARUY decipher as follows 

123456789 10 11 12 

Cipher._ NIIGXGAMXCAD 

Plam_ I L E 0 R 

The word after ARMY is probably WILL This leads to the insertion of the letter W m the plam 
component and G m the cipher component In a short tune both components can be completely 
established 

g In passmg, it may be well to note that m the illustrative message m paragraph 60o the 
very frequent occurrence of tripled letters (MMM, WWW, FFF, etc) mdicates the presence of a 
frequently used short word, a frequently used ending, or the like, the letters of which are sequent 
m the plam component An astute cryptanalyst who has noted the frequency of occurrence 
of such triplets could assume the value THE for them, go through the entare text replacing all 
triplets by THE, and then, by applying the pnnciples of mdirect sjmunotry, bmld up the plam 
component m a short time With that much as a start, solution of the enture message would be 
considerably sunphfied. 

h The prmciples elucidated m this paragraph may, of course, also bo applied to oases of 
progressive systems m which the progression is by mtervals greater than 1, and, with necessary 
TnfwJififtfttinna , to casos m which the progression is not regular but follows a specific pattern, such 
as 1-2-3, 1-2-3, , or 2-6-7-3-1, 2-6-7-3-1, and so The latter types of progression 

are encountered m certam mechamcal cryptographs, the study of which will be reserved for 
future texts 






































SECTiON XIV 
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THE “MONOALPHABETICITY” OR TEST” 

Fanigrapb 

Purpose of the * test .... 62 

Derivation of the * test_ ___ 63 

53. Purpose of the * (phi) test — a The student has noted that the x test is based upon the 
general theory of coincidences and employs the probabihty constants k, and k. There is one 
more test of a related nature which may be useful for him to understand and its explanation 
wiU be given m the succeedmg paragraphs 

b In paragraph 48e it was stated that two monoalphabetic distributions when correctly 
oeonhined will yield a single distribution which should still be monoalphabetic m character 
This question arises, therefore, m the student’s mmd Is there a test whereby he can ascertain 
methouatically whether a distribution is monoalphabetic or not, especially m the case of one 
which has relatively few data? Such a test has been devised and is termed the (phi) test ” 
63. Denvation of the $ test. — a Consider a monographic or umhteral frequency distribution 
which IS monoalphabetic m composition If there is a total of N letters m the distribution 

m a system m which there are n possible elements, then there is a possible total of —-- 

pairs of letters (for comparison purposes) 

b Let the symbolrepresent the number of occurrences of A, fa the number of occurrences 
of B, and so on to/z With regard to the letter A then, there ^ comcidences (Again 

the combmations of /a thmgs taken two at a time) With regard to the letter B, there are 
^ comcidences, and so on up to"^^^—^ comcidences for the letter Z Now it has been 

seen that according to the k test, m ^ comparisons of letters forming the two members 

of pairs of letters m normal Enghsh plum text, there should be ——^ - - comcidences, where 

K, is the probabihty of monographic coincidence for the language m question 

c Now the expected value of to the theoret¬ 

ical number of comcidences to be expected m —^ —— compansons of two letters, which for 

normal plain text is times and for random text is times — That is, for 

plain text 

(IX) Expected value +fz{fz-l)=icpN[N—l), and for random 

text 

Expected value of ^ ^ 

( 94 ) 
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(X) Expeeted value of /A((A-l)+/B(/a-l)+ +fz{fz~l)==KrN(N-l) 

If for the left-hand side of equations (IX) and (X) the symbol E (^) is used, then these equations 
become 

(XI) Foiplamtext Ei^p)—KpNiN—l) 

(XII) For random text i?($r)=/eriV(iV—1), 

where E{^) means the average or expected value of the expression m the parenthesis, k, and 
Kf are the probabilities of monographic comcidence m plum and m random text, respectively 
d Now m normal English plam text it has been found that 0667 For random text 
of a 26-letter alphabet k,— 038 Therefore, equations (XI) and (XII) may now be written 
thus 

(XIII) For normal English plam text E(^p)= 0667 N(N—1) 

(XIV) For random text (26-letter alphabet) E(^r)— 0385 N'(N—1) 

e By employmg equations (XIII) and (XIV) it becomes possible, therefore, to test a piece 
of text for monoalphabeticity or for “randomness ” That is, by using these equaticms one can 
mathematically test a very short cryptogram to ascertam whether it is a monoalphabetically 
enciphered substitution or involves several alphabets so that for all practical purposes it is 
equivalent to random text This test has been teimed the $ test 

64 Applying the test — a Given the following short piece of text, is it likely that it is 

normal English plam text enciphered monoalphabetically? 

ABCDEFGHIJKLMNOPQRSTUVWXYZ N=25 
For this case the observed value of <E> is 

(lX0)-J-(lX0)-l-(2Xl)+(3X2)-f(4X3)-l-(2Xl) + (lX0)-l-(4X3)-}-(2Xl)-[-(lX0)-t-(lX0)-|- 
(3 X 2)=2+6-f-12 4-2-h 12-f 2 4-6=4 0 

If this text were monoalphabetically enciphered English plam text the expected value of $ is 
E{^p)=KpN{,N-l)= 0667X25X24=40 0 
If the text were random text, the expected value of # is 

E{^r)=KrN{N-l)= 0385X25X24=23 1 

The conclusion is warranted, therefore, that the cryptogram is probably monoalphabetic sub¬ 
stitution, smce the observed value of 4>(40) more closely approximates the expected value for 
English plam text (40 0) than it does the expected value for random text (23 1) (As a matter 
of fact, the cryptogram was enciphered monoalphabetically ) 

b Here is another example Given the foUowmg senes of letters, does it represent a 
selection of English text enciphered monoalphabetically or does it more nearly represent a 
random selection of letters? 

YOUIJ ZMMZZ HRNQC XIYTW RGKLH 




96 


The distnbution and calcidation are as follows 

ABCDEFGHIJKLMNOPQRSTUVWXYZ 
... 0002000600^02 00 0026 

sy(/—1)=18 (That IS, observed value of $=18) 

£($p)= 0667X25X24=40 0 (That is, expected value of $,=40 0) 

The conclusion is that the senes of letters does not represent a selection of Enghsh text mono- 
alphabetically enciphered Whether or not it represents a random selection of letters cannot 
be told, but it may be said that if the letters actually do constitute a cryptogram, the latter is 
probably polyalphabetically enciphered (As a matter of fact, the latter statement is true, for 
the message was enciphered by 26 alphabets used m sequence ) 

c The $ test is, of course, closely related to the x test and denves from the same general 
theory as the latter, which is that of coincidence When two monoalphabetic distnbutions 
have been combmed mto a single distnbution, the x test may be apphed to the latter as a check 
upon the || test. It is also useful m testmg the columns of a supenmposition diagram, to ascer- 
tam whether or not the columns are monoalphabetic 


Section XV 


CONCLUDING REMARKS 


Oonduding remarks on aperiodic substitution systems. 
Synoptic table- 


66 

66 


66. Concludmg remarks on apenodic substitution systems .—a The vanous systems 
descnbed m the foregomg pages represent some of the more common and well-known methods 
of mtroducing complexities m the general scheme of cryptographic substitution with the view 
to avoidmg or suppressmg penodicity There are, of course, other methods for accomphshmg 
this purpose, which, while perhaps a bit more complex from a practical pomt of view, yield more 
desirable results from a cryptographic pomt of view That is, these methods go deeper mto the 
heart of the problem of cryptographic secunty and thus make the task of the enemy crypt¬ 
analyst much harder But studies based on these more advanced methods will have to be 
postponed at this tune, and reserved for a later text 

b Thus far m these studies, aside from a few remarks of a very general nature, no attention 
has been paid to that other large and important class of ciphers, viz, transposition It is desir¬ 
able, before gomg further with substitution methods, that the student gam some imderstanding 
of how to solve certam of the more simple varieties of transposition ciphers Consequently, 
m the text to succeed the present text, the student will temporarily lay aside the vanous useful 
methods and tools that he has been given for the solution of substitution ciphers and wdl turn 
his thoughts toward the methods of breakmg down transposition ciphers 

66. Synoptic table.—Contammg the plan mstituted m previous texts, of summarizing the 
textual matenal m the form of a very condensed chart called An Analytical Key for Mihtary 
Cryptanalysis, the outline for the studies covered by Part III is shown on p 119 
(97) 





APPENDIX 


Additional Notes on Methods for Solving Plain-Text Auto-Keted Ciphers 


Paragraph 

Introductory remarks. 1 

9«mple “mechanical” solution. 2 

Another “mechanical” solution.. 3 

Solution of plain-text auto-keyed cryptograms when the introductory key is a word or phrase_ 4 

Subsequent steps after determining the length of the introductory key ... _ 5 

Conversion of foregoing aperiodic cipher into periodic form...... 6 

Concluding remarks on auto-key systems. 7 


1. Introductory remarks .—a In paragraph 33 of the text proper it was indicated that the 
method elucidated m paragraph 32 for solvmg plain-text auto-keyed ciphers is likely to be suc¬ 
cessful only if the cryptanalyst has been fortunate m his selection of a “probable word ” Or, to 
put it another way, if the “probable words” which his imagmation leads him to assume to be 
present m the text are really not present, then he is unfortunate, for solution will escape him 
Hence, it is desirable to point out other prmciples and methods whicli are not so subject to chance 
But because most of these methods are applicable only in special cases and because m general it 
is true that auto-key systems are no longer commonly encountered in practical military cryptog¬ 
raphy, it ’w as thought best to exclude the exposition of these principles and methods from the 
text proper and to add them in an appendix, for the study of such students as find them of 
particidar interest 

h A complete discussion of the solution of plain-text auto-key systems, with examples, 
would require a volume m itself Only one or two methods will be described, therefore, leavmg 
the development of additional prmciples and methods to the ingenuity of the student who wishes 
to go more deeply mto the subject The discussion herein will be presented under separate 
headings, dependent upon the types of primary components employed 

c As usual, the types of primary components may be classified as follows 
(1) Primary components arc identical 

(a) Both components progress m the same direction 

(b) Both components progress m opposite directions 
(2) Pnmary components are different 

2. Simple “mechanical” solution —a (1) Taking up the case wherein the two identical 
primary components progress in the same direction, assume the following additional factors to 
be known by the cryptanalyst 

(a) The pnmary components are both normal sequences 

(b) The encipherment is by plain-text auto-keying 

(c) The enciphermg equations are 0k/2=0i/i, 0p/i=0o/s 

(2) A message beginnmg QVGLB TPJTF is intercepted, the only unknown factor is 
the initial key letter Of course, one could try to decipher the message using each key letter in 
turn, begmnmg with A and contmmng until the correct key letter is tried, whereupon plam text 
will be obtamed But it seems logical to tlunk that all the 26 possible “decipherments” might 
be denved from the first one, so that the process might be much simplified, and this is true, as 
(98) 


will now be shown Talang the two cipher groups under consideration, let them be “deciphered” 
with mitial key letter A 

Cipher.-...-. 

Deciphered with keyletter k. .-.QFBKRCNWXI 

The deciphered text is certainly not “plam text ” But if one completes the sequences imtiated 
by these letters, using the direct standard sequence for the even columns, the reversed standard 
for the odd columns, the plam text sequence is seen to reappear on one generatrix It is HOSTILE 
F0R( CE) From this it appears that instead of going through the labor of making 26 successive 
tnals, which would consume considerable time, aU that is necessary is to have a set of strips 
bearing the normal direct sequence and another set beanng the reversed normal sequence, and 
to alig n the stops, alternately direct and reversed, to the first “decipherment ” The plain text 
will now reappear on one generatrix of the completion diagram (See Fig. 1 ) 

QVGLBTPJTF 
QFBKRCNWXI 
PGALQDMXWJ 
OHZMPELYVK 
NIYNOFKZUL 
MJXONGJATM 
LKWPMHIBSN 
KLVQLIHCRO 
JMURKJGDQP 
INTSJKFEPQ 
HOSTILEFOR* 

GPRUHMDGNS 
FQQVGNCHMT 
ERPWFOBILU 
DSOXEPAJKV 
CTNYDQZKJW 
BUMZCRYLIX 
AVLABSXMHY 
ZWKBATWNGZ 
YXJCZUVOFA 
XYIDYVUPEB 
WZHEXWTQDC 
VAGFWXSRCD 
UBFGVYRSBE 
TCEAUZQTAF 
SDDITAPUZG 
RECJSBOVYH 

6 The pecuhar nature of the phenomenon just observed, mz, a completion diagram with the 
vertical sequences in adjacent columns progressing in opposite directions, those m alternate 
columns in the same direction, caUs for an explanation Although the matter seems rather 
mystenous, it will not be hard to understand First, it is not hard to see why the letters in 
column 1 of Figure 1 should form the descending sequence QPO for these letters are merely 
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the ones resulting from the successive “decipherment” of Qo by the successive key letters A, B, 
C, Now since the “decipherment” obtained from the 1st cipher letter m any row m 

Rgure 1 becomes the key letter for “deciphenng” the 2d cipher letter m the same row, it is 
apparent that as the letters m the 1st column progress in a reversed normal (descendmg) order, 
the letters in the 2d column must progress in a direct normal (ascending) order The matter 
may perhaps become more clear if encipherment is regarded as a process of addition and de¬ 
cipherment as a process of subtraction. Instead of primary components or a Vigenlre square, 
one may use simple arithmetic, assigmng numencal values to the letters of the alphabet, begm- 
nin g with A—0 and endmg with Z=25 Thus on the basis of the pair of enciphering equations 
0k/a=0irt> 6p/i=0o/!i the letter H, enciphered by key letter with direct pnmary components 
yields To But using the followmg numencal values 

ABCDEFGHIJKLMNOPQRSTUVWXYZ 

0 1 a 3 4 3 0 7 8 g 10 11 12 13 14 16 16 17 18 19 20 21 22 23 24 28 

the same result may be obtamed thus Hp(MO=7-|-12=19=To Every time the number 25 is 
exceeded in the addition, one subtracts 26 from it and finds the letter eqmvalent for the remam- 
der In decipherment, the process is one of subtraction ‘ For example To(Mt=19— 12=7= 
Hp, Do(Rk)=3—17=[(26-}-3)—17]=29—17=12=Mp Using this anthmetical equivalent of 
normal shding-stnp encipherment, the phenomenon just noted can be set down m the form of a 
diagram (Fig 2) which will perhaps make the matter clear 

* It will be noted that if the letters of the alphabet are numbered from 1 to 26, in the usual manner, the 
arithmetical method must be modified in a minor particular in order to obtain the same results as are given by 
employing the normal VigenSre square This modification consists merely in subtracting 1 from the numencal 
value of the key letter Thus 

ABCDEFGHIJKLMNOPQRSTUVWXYZ 

1 a 3 4 8 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 as 26 

Hp(Mk) = 8+ (13-1) = 8+ 12=20=T. 

T.(Mk) =20- (13-1) = 20- 12=8=Hp 

For an interesting extension of the basic idea involved in arithmetic cryptography, see 

Hill, Lester S Cryptography tn an Algebraic Alphabet American Mathematical Monthly, Vol XXXVI, 
No 6, 1929 

Ibid Concerning certain linear transformation apparatus of cryptography American Mathematical Monthly, 
Vol XXXVIII, No 3, 1931 
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QVGLBTPJetc 

Qe(Ak)=16- 0=I6=Q--»Q F B K R 

Vp(Qk)=2I-16= 5=F_LJ I I 

Go(Fk)= 6- 5= 1=B_L_U 

Lp(Bk)=Il- l=10=K____L_i_Lj 
Bo(Kk)= I-10=17=R_ ; ' ; ; 


Qo{Bk)=I6- 1=16=P- 
Ve(Pk)=21-15= 6=G. 
Go(Gk)= 6- 6= 0=A. 
Le(Ak)=Il- 0=I1=L. 

Bp(Lk)= 1-11=16=0- 


-P G A L Q 

-U I ‘ ■ 


Q.{C,)=16- 2=14=0 
V,(0k)=21-14= 7=H 
Gc(Hk)= 6- 7=2 5=Z 
Lp{Zk)=ll-25=12=M 
Be{Mk)= 1-12=15=P 

Note how homologous letters of the three rows (jomed by vertical dotted hues) form alternately 
descendmg and ascending normal sequences 

c When the method of encipherment based upon enciphermg equations 0k/3=Oi/i, 0p/9=©e/i 
IS used mstead of the one based upon enciphering equations 0k/2=0i/i, 0p/i=0o/2» the process 
mdicated above is simplified by the fact that no alternation in the direction of the sequences 
in the completion diagram is required For example 

Cipher. YHEBPDTBJD 

Deciphered A=A.. YFJKZCVWFI 

ZGKLADWXGJ 

AHLMBEXYHK 

BIMNCFYZIL 

CJNODGZAJM 

DKOPEHABKN 

ELPQFIBCLO 

FMQRGJCDMP 

GNRSHKDENQ 

♦HOSTILEFOR 

FlQCB* 3 

d (1) In the foregoing example the pnmary components were normal sequences, but the 
case of identical mixed components may be handled in a similar manner Note the following 
example, based upon the following pnmary component (which is assumed to have been recon¬ 
structed from previous work) 

FBPYRCQZIGSEHTDJUMKVALWNOX 
Message _ USINL YQE0P...etc 



FiouaE 2 
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(2) First, the message is “deciphered” with the initial key-letter a, and then a completion 
diagram is established, using sliding strips bearing the mixed primary component, alternate 
strips bearin'’ tbe reversed sequence Note Figure 4, m which the plain text, HOSTILE 
F0R( CE), reappears on a single generatrix Note also that whereas m Figure 1 the odd columns 
contain the pi unary sequence in the reversed order, and the even columns contain the sequence 
in the direct order, in Figure 4 the situation is reversed the odd columns contam the primary 
sequence in the direct order, and the even columns contain the sequence m the reversed order 
This point IS brought to notice to show that it is immatenal whether the direct order is used 
for odd columns or for even columns, tbe alternahon in direction is all that is required in this 
type of solution 

e (1) There is next to be consideied the case m which the two prunary components progiess 
in opposite diiections [par Ic (1) (b)] Here is a message, known to have been enciphered by 
reversed standard alphabets, plain-text auto-keymg having been followed 

XTWZLXHZRX 

(2) The procedure m tlus case is exactly the same as before, except that it is not neccssaiy 
to have any alternation m direction of the completion sequences, which may be either that of 
the plam component or the cipher component Note the solution m Figure 5 Let the student 
ascertain whv the alternation m direction of the completion sequences is not necessary m this 
case 

(3) In the foregomg case the alphabets were reversed standard, produced by the sliding 
of the normal sequence against its reverse But the underlying prmciple of solution is the same 
even if a mixed sequence were used mstead of the normal, so long as the sequence is known, the 
procedure to be followed is exactly the same as demonstrated in subparagraphs (1) and (2) hereof 
Note the following solution 

Message 

VDDNC TSEPA 


Plain component_ FBPYRCQZIGSEHTDJUMKVALWNOX 

Cipher component XONWLAVKMUJDTHESGIZQCRYPBF 


Note here that the primary mixed sequence is used for the completion sequence and that the 
plam text, HOSTILE FOR(CE), comes out on one generatrix It is immaterial whether the 
direct or reversed mixed component is used for the completion sequence, so long as aU the 
sequences m the diagram progress m the same direction (See Fig 6 ) 

y (1) There remains now to be considered only the case in which the two components 
are different mixed sequences Let the two primary components be as follows 


Plam . ABCDEFGHIJKLMNOPQRSTUVWXYZ 

Cipher . FBPYRCQZIGSEHTDJUMKVALWNOX 


and the message 


C F U Y L 


V X U D J 
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(2) First “decipher” the message with any arbitrarily selected imtial key letter, say A, 
and complete the plain component sequence m the first column (Fig 7a) 


Cipher._ CFUYLVXUDJ CFUYLVXUDJ CFUYLVXUDJ 

Plain. LFQXWXAWSF LFQXWXAWSE LFQXWXAWSE 


M 

N 

0 

P 

Q 

R 

s 

T 

U 

V 

w 

X 

Y 
Z 
A 
B 
C 
D 
E 
F 
G 
H 
I 
J 
K 


M J 
NTD 

o"‘c 

P Y 

q u 

R W 

s Q 

T N 
U K 

V H 
W E 
X B 

Y X 
Z T 
A G 
B Z 
C V 
D M 
E P 
F A 
G R 
H 0 
I S 
J L 
K I 


M J B C 
N D C Y 
0 C L I 
P Y N G 
Q U A J 
R W U N 
S Q K L 
T N T Q 
U K Y A 

V H E S 
W E F D 
X B P B 

Y X R Z 
Z T D P 
A E H R 
B Z J 0 
C V X E 
D M Z W 
E P 0 F 
F A W H 
G R M M 

♦HOST 
I S G 
J L V 
K I I 


FiotmE 7a 






Now prepare a strip beanng the cipher component reversed, and set it below the plam component 
so that Fp=Lc, a setting given by the 1st two letters of the spurious “plam text” recovered 
Thus* 

Plain_ ABCDEFGHIJKLMNOPQRSTUVWX^Z 

Cipher-_ FXONWLAVKMUJDTHESGIZQCRYPB 


(3) Now opposite each letter of the completion sequence m column 1, write its plam- 
component equivalent, as given by the juxtaposed sequences above This gives what is shown 
m Figure 76 Then reset the two sequences (reversed cipher component and the plam com¬ 
ponent) so that Qp==Fo (to correspond with the 2d and 3d letters of the spurious plam text), 
write down the plam-component equivalents of the letters m column 2, forming column 3 
Contmue this process, scanning the generatrices from time to time, resettmg the two components 
and findmg equivalents from column to column, until it becomes evident on what generatrix 
the plam text is reappearmg In Figure 7c it is seen that the plam text generatrix is the one 
beginnmg HOST, and from this pomt on the solution may be obtained directly, by usmg the 
two primary components 
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(4) When the plam component is also a mixed sequence (and different from the cipher 
component), the procedure is identical with that outlmed m subparagraphs (l)-(3) above. 
The fact that the plam component m the precedmg case is the normal sequence is of no particular 
sigmficance m the solution, for it acts as a mixed sequence would act under similar circumstances 
To demonstrate, suppose the two foUowmg components were used m encipherment of the 
message below 


Plam. WBVIGXLHYAJZMNFORPEQDSCTKU 

Cipher_ FBPYRCQZIGSEHTDJUMKVALWNOX 


Message_ BBVZU DQXJD 

To solve the message, “decipher” the text with any arbitrarily selected mitial key letter and 
proceed exactly as m subparagraphs (2) and (3) above Thus 

Cipher-.... BBVZUDQXJD 

“Plam” (0k=X). VYRIYZEFOR 

Note the completion diagram m Figure 8 which shows the word HOST very soon m the 
process From this pomt on the solution may be obtamed directly, by usmg the two primary 
components 

BBVZUDQXJD 
VYRIYZEFOR 
I Q N J 
G E Y G 
X V W Z 
L L K 0 
♦HOST 
Y K B 
A H H 
J M V 
Z D X 
M J G 
N G J 
F B E 
0 I Z 
R T L 
P U I 
E R 0 
Q S A 
D N C 
S P P 
C C F 
T F Q 
K A U 
U Z M 
W X D 

FlOUSX 8, 
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3. Another “mechanical” solution —a Another “mechanical” solution for the foregoing 
cases will now be described because it presents rather mterestmg cryptanalytic sidehghts 
Take the message 

REFERENCE HIS PREFERENCE IN REFERENCE 
BOOKS AND REFERENCE CHARTS 

and enciphei it by plam-text auto-key, with normal duect primary components, mitial key 
setting Ap=Gc Then note the underscored repetitions 

REFERENCEHISPREFERENCEINREFE 
X VJJVVRPG L P A H G VJJVVRPG M V E V J J 

RENCEBOOKSANDREFERENCECHARTS 
V V R P G FPCYCSNQU VJJVVRPG G J H Y K L 

b Now suppose the message has been intercepted and is to be solved The only unknown 
factor will be assumed to be the imtial key letter Let the message be “deciphered” by means 
of any initial key letter,“ say A, and then note the underscored repetitions in the spurious plain 
text 


Cipher_ X VJJVVRPG L P A H G VJJVVRPG M V E V J J 

“Plain text”_ XYLYXYTWK B 0 M V LKZKLKHIY 0 H X Y L Y 


Cipher _ V V R P G FPCYCSNQU VJJVVRPG G J H Y K L 

“Plain text”_ X Y T W K VUIQMGHJ LKZKLKHIY I B G S S T 


The oiigmal four 8-letter repetitions now turn out to be two 
different sets of 9-letter repetitions This calls for an explana¬ 
tion Let the spurious plam text, with its leal plain text be 
transcribed as though one were dealmg with a periodic cipher 
mvolvmg two alphabets, as shown m Figure 9 It wdl here be 
seen that the letteis in column 1 are monoalphabetic, and so are 
those m column 2 In other words, an auto-key cipher, which 
is commonly regarded as a polyalphabetic, aperiodic cipher, has 
been converted mto a 2-alphabet, periodic cipher, the mdividual 
alphabets of which are now monoalphabetic m nature The two 
repetitions of XYLYXYTWK represent encipherments of 
the word REFERENCE, m alphabets 1-2-1-2-1-2-1-2-1, the two 
repetitions of LKZKLKHIY likewise represent encipher¬ 
ments of the same word but m alphabets 2-1-2-1-2-1-2-1-2 

c Later on it will be seen how this method of convertmg an 
auto-key cipher mto a penodic cipher may be apphed to the 
case where an introductory key word is used as the mitial keying 
element mstead of a smgle letter, as m the present case 


1-2 1-2 

RE E F 

X Y K Z 

F E E R 

L Y K L 

RE E N 

X Y K H 

N C C E 

T W I Y 

EH IN 

KB OH 

IS RE 

0 M X Y 

PR F E 

V L L Y 


’ Except the actual key letter or a letter 13 intervals from it See subparagraph (7) below 


1-2 
R E 
X Y 
N C 
T W 
E B 
K V 
0 0 
U I 
K S 
Q M 
A N 
G H 
D R 
J L 


1-2 
E F 
K Z 
E R 
K L 
E N 
K H 
C E 
I Y 
C H 
I B 
A R 
G S 
T S 
S T 


ik. 
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d The student has probably already noted that the phenomena observed m this sub- 
paragraph are the same as those observed m subparagraph 2b In the latter subparagraph it 
was seen that the direction of the sequences m alternate columns had to be reversed m order 
to bring out the plam text on one generatrix If this reversal is not done, then obviously the 
plam text would appear on two generatrices, which is equivalent to having the plam text reduced 
to two monoalphabets 

e When reciprocal components are employed, the spurious plam text obtained by “decipher¬ 
ment” with a key settmg other than the actual one will be monoalphabetic throughout Note 
the following encipherment (with initial key rotting Ap=Gc, using a reversed standard sequence 
sliding agamst the direct standard) and its “decipherment” by settmg these two components 

Ap=A, 


Plam text_ REFERENCEHISPREFERENCE 

Cipher_ PNZBNNRLYXZQDYNZBNNRLY 


Spunous plam text-. LYZYLYHWYBCMJLYZYLYHWY 

Here the spurious plam text is wholly monoalphabetic 

f The reason for the exception noted m footnote 2 on page 106 now becomes clear For 
if the actual mitial key letter (G) were used, of course the decipherment yields the correct plam 
text, if a letter 13 intervals removed from G is used as the key letter, the cipher alphabet selected 
for the first “decipherment” is the reciprocal of the real initial cipher alphabet and thereafter 
aU alternate cipher alphabets are reciprocal Hence the spunous text obtained from such a 
“decipherment” must be monoalphabetic 

g In the foregoing case the primary components were identical normal sequences progress¬ 
ing m the same direction If they were mixed sequences the phenomena observed above would 
still hold true, and so long as the sequences are known, the indicated method of solution may be 
apphed 

h When the two pnmary components aie known but differently mixed sequences, this 
method of solution is too involved to be practical It is more practicable to try successive 
mitial key letters, noting the plain text each time and resetting the stops until the correct 
settmg has been ascertamed, as will be evidenced by obtaining intelligible plain text 

4 Solution of plain-text auto-keyed cryptograms when the introductory key is a word or 
phrase —a In the foregomg discussion of plain-text auto-keying, the introductory key was 
assumed to consist of a smgle letter, so that the subsequent key letters are displaced one letter 
to the nght with respect to the text of the message itself But sometimes a word or phrase 
may serve this function, m which case the subsequent key is displaced as many letters to the 
nght of the mitial plam-text letter of tne message as there are letters m the initial key T his 
will not, as a rule, mterfere m any way with the application of the principles of solution set 
forth m paragraph 28 to that part of the cryptogram subsequent to the introductory key, and 
a solution by the probable-word method and the study of repetitions can be reached However, 
it may happen that toal of this method is not successful m certain cryptograms because of the 
paucity of repetitions, or because of failure to find a piobable word m the text When the cipher 
alphabets are known there is another point of attaek wlueh is useful and mterestmg The 
method consists m findmg the length of the introductory key and then solving by frequency 
pnnciples Just how this is accomphshed will now be explained 

b Suppose that the introductory key word is HORSECHESTNUT, that the plam-text message 
IS as below, and that identical pnmary components progressing in the same direction are used 
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to encipher the message, by enciphenng equation 01/2=01/1, 0p/i=0e/j Let the components 
be the normal sequence The encipherment is as follows 


1 2 3 4 S « 7 8 9 10 11 12 13 14 15 18 17 18 19 20 21 22 23 24 as 2« 

Key. HORSECHESTNUTMYLEFTFLANKIS 

Plam -- MYLEFTFLANKISRECEIVINGHEAV 

Cipher . TMCWJVMPSGXCLDCNINONYGUOIN 

Key. RECEIVINGHEAVYARTILLERYFIR 

Plam . YARTILLERYFIREENEMYISMASSI 

Cipher .. PETXQGTRXFJIMCEEXUJTWDYXAZ 

Key_ EENEMYISMASSINGTROOPSTOLEF 

Plam _ NGTROOPSTOLEFTFRONTANDCONC 

Cipher, .. RKGVAMXKFODWNGLKFBHPFWQZRH 

Key- TFRONTANDCONCENTRATINGARTI 

Plam.... .. ENTRATINGARTILLERYTHEREXWI 

Cipher __ XSKFNMIAJCFGKPYXIYMPRXEOPQ 

Key. -- LLERYTHEREXWILLNEEDCONSIDE 

Plam ... LLNEEDCONSIDERABLEREINFORC 

Cipher.. . WWRVCWJSEWFZMCLOPIUGffAXWUG 

Key- RABLEREINFORCEMENTSTOMAINT 

Plam - EMENTSTOMAINTAINMYPOSITION 

Cipher .. VMFYXJXWZFWEVEURZRHHGUTQBG 


It wiU now be noted that smce the mtroductory key contains 13 letters the 14th letter of the 
message is enciphered by the 1st letter of the plam text, the 16th by the 2d, and so on Likewise, 
the 27th letter is enciphered by the 14th, the 28th by the 15th, and so on Hence, if the 1st 
cipher letter is deciphered, this will give the key for deciphermg the 14th, the latter wiU give 
the key for the 27th, and so on An important step in the solution of a message of this kmd 
would therefore mvolve ascertaimng the length of the mtroductory key This step wiU now 
he explained 

c Smce the plam text itself constitutes the key letters m this system (after the mtroductory 
key), these key letters will occur with their normal frequencies, and this means that there will 
be many occurrences of E, T, 0, A, N, I, R, S, enciphered by E^, there will be many occurrences 
of these same high-frequency letters enciphered by T^, by 0^, by Ak, and so on In fact, the 
number of times each of these combmations wiU occur may be calculated statistically With 
the enciphering conditions set forth under b above, Ep enciphered by Tk, for example, will yield 
the same cipher eqmvalent as Tp enciphered by Ek, m other words two encipherments of any 
pair of letters of wich either may serve as the key for enciphermg the other must yield the same 
cipher resultant ® It is the cryptographic effect of these two phenomena workmg together 
which permits of ascertaining the length of the mtroductory key m such a case For every 
time a given letter, 0p, occurs m the plain text it will occur n letters later as a key letter, 0k, and 
n m this case equals the length of the mtroductory key Note the followmg illustration 

* It IS important to note that the two components must be identical sequences and progress m the same 
direction If this is not the case, the entire reasoning is mapphcable 
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1 2 3 4 6 6 7 8 9 10 11 12 13 1 2 3 4 5 6 7 8 9 10 11 12 13 

(1) Key.... . HORSECHESTNUT,. T 

(2) Plam. . T E . . . . 

(3) Cipher.. X ... 

123458780 

(1) Key. E 

(2) Plam . . T . 

(3) Ciphei. X 


Here it will be noted that Ep m hne (2) has a Tp on either side of it, at a distance of 13 intervals, 
the first encipherment (Ep by Tk) yields the same equivalent (X,) as the second encipherment 
(Tp by Ek) Two cipher letters are here identical, at an interval equal to the length of the intro¬ 
ductory key But the converse is not true, that is, not every pair of identical letters m the cipher 
text represents a case of this type For m this system identity in two cipher letters may be 
the result of the followmg three conditions each having a statistically ascertainable probabihty 
of occurrence 

(1) A given plam-text letter is enciphered by the same key letter two different times, at an 
mterval which is purely accidental, the cipher eqmvalents are identical but could not be used 
to give any information about the length of the mtroductory key 

(2) Two different plam-text letters are enciphered by two different key letters, the cipher 
equivalents are fortuitously identical 

(3) A given plam-text letter is enciphered by a given key letter and later on the same plam- 
text letter serves to encipher another plam-text letter which is identical with the first key letter, 
the cipher eqmvalents are causally identical 

It can be proved that the probabihty for identities of the third type is greater than that for 
identities of either or both 1st and 2d types for that interval which corresponds with the length 
of the introductory key, that is, if a tabulation is made of the intervals between identical letters m 
such a system as the one bemg studied, the mterval which occurs most frequently should coincide 
with the length of the mtroductory key The demonstration of the mathematical basis for this 
fact 18 beyond the scope of the present text, but a practical demonstration will be convmcmg 

d Let the illustrative message be transcribed m hnes of say 11, 12, and 13 letters, as m 
Figure 10 
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In each transcription, every pair of supenmposed letters is noted and the number of identities 
IS indicated by ringing the letters involved, as shown above The number of identities for on 
assumed introductory-key length 13 is 9, as against 3 for the assumption of a key of 11 letters, 
and 5 for the assumption of a key of 12 letters 

e Once having found the length of the introductoiy key, two hnes of attack are possible 
the composition of the key may be studied, winch will yield sufficient plain text to get a stait 
toward solution, or, the message may be reduced to penodic terms and solved as a repeating-key 
cipher The first hne of attack will be discussed first, it being constantly borne in mind in this 
paragraph that the entire discussion is based upon the assumption that the cipher alphabets 
are known alphabets The illustrative message of h above will be used 

5 Subsequent steps after determming the length of the mtroductory key —a Assume that 
the first letter of the introductory key is A and decipher the 1st cipher letter Tc (with direct 
standard alphabets) This yields Tp and the latter oecomes the key letter for the 14th letter of 
the message The 14th letter is decipheied Do (Tk)=Kp, the latter becomes the key letter for 
the 27th letter and so on, down the entire first column of the message as transcribed m hnes of 
13 letters The same procedure is followed using B as the imtial key letter, then C, and so on 
The message as it appears for the fiist three tnals (assuming A, B, then C as the imtial key letter) 
IS shoivn in Figure 11 
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h Inspection of the results of these three tnals soon shows that the entire senes of 26 
tnals need not be made, for the results can be obtained from the very first tnal This may be 
shown graphically by supenmposing merely the results of the first three tnals homorUaUy 
Thus 


Cipher letters of Col 1, Fig 11.. 


. T D P C R G X P W C V E 


Keyletters.. 


[A. TKFXUMLESKLT 

. SLEYTNKFRLKU 

,C-. RMDZSOJGQMJV 

I? 111111111111 


T D P C RGXPWCVE 


c It will be noted that the vertical sequences in adjacent columns proceed in opposite 
directions, whereas those m alternate columns proceed m the same direction The explanation 
for this alternation m progression is the same as m the 
pievious case wherein this phenomenon was encountered 
(par 26), and the sequences m Figure 12 may now be 
completed very qmckly The chagram becomes as shown 
m Figure 13 

d One of the honzontal hnes or geneiatiices of figure 
13 IS the correct one, that is, it contains the actual plain¬ 
text equivalents of the 1st, 14th, 27th, letters of the 
message The correct generatrix can be selected by mere 
oculai examination, as is here possible (see generatrix 
marked by astensk m Fig 13), or it mav be selected by a 
frequency test, assigning weights to each letter according 
to its normal plain-text frequency (See par 14/ of 
Mdvtary Cryptanalysts, Part II) 


T K F 

X U M L 

E 

S 

K L T 

S L E 

Y T N K 

F 

R 

L K U 

R M D 

Z S 0 J 

G 

Q 

M J V 

Q N C 

A R P I 

H 

P 

N I W 

P 0 B 

B Q Q H 

I 

0 

0 H X 

0 P A 

C P K G 

J 

N 

P G Y 

N Q Z 

D 0 S F 

K 

M 

Q F Z 

M R Y 

E N T E 

L 

L 

REA* 

L S X 

F M U D 

M 

K 

S D B 

K T W 

G L V C 

N 

J 

T C C 

J U V 

H K W B 

0 

I 

U B D 

I V U 

I J X A 

P 

H 

V A E 

H ff T 

J I Y Z 

Q 

G 

ff Z F 

G X S 

K H Z Y 

R 

F 

X Y G 

F Y R 

L G A X 

S 

E 

Y X H 

E Z Q 

M F B W 

T 

D 

Z ff I 

DAP 

N E C V 

U 

C 

A V J 

C B 0 

0 D D U 

V 

B 

B U K 

B C N 

POET 

W 

A 

C T L 

ADM 

Q B F S 

X 

Z 

D S M 

Z E L 

R A G R 

Y 

Y 

E R N 

Y F K 

S Z H Q 

Z 

X 

F Q 0 

X G J 

T Y I P 

A 

ff 

GPP 

W H I 

U X J 0 

B 

V 

H 0 Q 

V I H 

V W K N 

C 

u 

I N R 

U J G 

W V L M 

D 

T 

J M S 


e Identical procedure 18 followed with respect to columns 2, 3, 4, of Figure 10c, with 
the result that the mitial key word HORSECHESTNUT is reconstructed and the whole message 
may be now deciphered quite readily 
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6 Conversion of foregoing aperiodic cipher into periodic form —a In paragraph 4 it was 
stated that an apenodic cipher of the foregoing type may be reduced to penodic terms and 
solved as though it were a repeatmg-key cipher, provided the primary components are known 
sequences The basis of the method lies in the phenomena noted m paragraph 26 An example 
will be given 

6 Let the cipher text of the message of paragraph 46 be set down agam, as m Figure 10c 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

T 

M 

C 

w 

J 

V 

M 

P 

s 

G 

X 

C 

L 

D 

C 

N 

I 

N 

0 

N 

Y 

G 

U 

0 

I 

N 

P 

E 

T 

X 

Q 

G 

T 

R 

X 

F 

J 

I 

M 

C 

E 

E 

X 

u 

J 

T 

W 

D 

Y 

X 

A 

Z 

R 

K 

G 

V 

A 

M 

X 

K 

F 

0 

D 

W 

N 

G 

L 

K 

F 

B 

H 

P 

F 

W 

Q 

Z 

R 

H 

X 

S 

K 

F 

N 

M 

I 

A 

J 

C 

F 

G 

K 

P 

Y 

X 

I 

Y 

M 

P 

R 

X 

E 

0 

P 

Q 

W 

W 

R 

V 

C 

W 

J 

S 

E 

W 

F 

Z 

M 

c 

L 

0 

P 

I 

U 

G 

W 

A 

X 

W 

U 

G 

V 

M 

F 

Y 

X 

J 

X 

W 

Z 

F 

w 

E 

V 

E 

U 

R 

Z 

R 

H H G 

Fiquei 10c 

U 

T 

Q 

B 

G 


Using direct standard alphabets (Vigen^re method), “decipher” the second Ime by means of 
the first fine, that is, takmg the letters of the second fine as cipher text, those of the first fine 
as key letters Then use the thus-found “plain text” as “key letters” and “decipher” the third 
fine of Figure 10c, as shown in Figure 14 Thus 


“Key”- TMCWJVMPSGXCL 

Cipher.. DCNINONYGUOIN 

“Flam”__ KQLMETZJOORGC 

“Key”. KQLMETZJOORGC 

Cipher....... PETXQGTRXFJIM 

“Plain”- FOILMNUIJRSCK 

Figcri 14. 


Contmue this operation for all the remaining lines of Figure 10c and wnte down the results m 
fines of 26 letters Thus 

1 2 3 4 5 6 7 8 9 10 11 12 18 14 15 16 17 18 19 20 21 22 2S 24 28 28 

TMCWJVMPSGXCLKQLMETZJOORGC 
FOILMNUIJRSCKXQWMIWZOUHFYP 
U U ILJ SQYWLHYYYMRAWJRRJLJBTJ 
LBK_JEVRRYTENBEXNZyRYAZLKCP 
SZEWIFLSFLVXXKMKTAPVEVMBXJ 
LAVFXUCSETVHMTUWUUNFOQAVUU 

Fiqcbe 16 
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Now wnte down the real plam text of the message in fines of 26 letters Thus 

1 2 3 4 6 6 7 8 9 10 11 12 13 14 16 16 17 18 19 20 21 22 23 24 25 26 

MYLEFTFLANKISRECEIVINGHEAV 

YARTILLERYFIREENEMYISMASSI 

NGTROOPSTOLEFTFRONTANDCONC 

ENTRATINGARTILLERYTHEREXWI 

LLNEEDCONSIDERABLEREINFORC 

EMENTSTOMAINTAINMYPOSITION 

FiQUBz 16 

c When the underlined repetitions m Figures 15 and 16 are compared, they are found to be 
identical in the respective columns, and if the columns of Figure 15 are tested, they wiU be found 
to be monoalphabetic The cipher message now gives every indication of bemg a repeatmg-key 
cipher It is not difficult to explain this phenomenon in the light of the demonstration given in 
paragraph 3fir First, let the key word HORSECHESTNUT be enciphered by the following alphabet 

ABCDEFGHIJKLMNOPQRSTUVWXYZ 

AZYXWVUTSRQPONMLKJIHGFEDCB 


“Plam”. HORSECHESTNUT 

“Cipher”. TMJIWYTWIHNGH 


Then let the message MY LEFT FLANK, etc , be enciphered by direct standard alphabets as 
before, but for the key add the monoalphabetic eqmvalents of HORSECHESTNUT TMJIW to 
the key itself, that is, use the 26-letter key HORSECHESTNUTTMJIWYTWIHNGH in a repeatmg-key 
manner Thus (Fig 17) 


1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 

Key_ HORSECHESTNUTTMJIWYTWIHNGH 

Plam__ MYLEFTFLANKISRECEIVINGHEAV 

Cipher__ TMCWJVMPSGXCLKQLMETZJOORGC 

Plam...... YARTILLERYFIREENEMYISMASSI 

Cipher.. FOILMNUIJRSCKXQWMIWZOUHFYP 

Plam_ NGTROOPSTOLEFTFRONTANDCONC 

Cipher._ UUKJSQYWLHYYYMRAWJRRJLJBTJ 

Plam. ENTRATINGARTILLERYTHEREXWI 

Cipher. LBKJEVRRYTENBEXNZURYAZLKCP 

Plam. LLNEEDCONSIDERABLEREINFORC 

Cipher . SZEWIFLSFLVXXKMKTAPVEVMBXJ 

Plam.. EMENTSTOMAINTAINMYPOSITION 

Cipher . LAVFXUCSETVHMTUWUUNFOQAVUU 


Fioubx 17 

The cipher resultants of this process of e7ic%phenng a message coincide exactly with those obtained 
from the “denphenng” operation that gave rise to Figure 15 How does this happen? 
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d First, let it be noted that the sequence TMJI , which forms the second half of the 
key for enciphering the text in Figure 17 may he described as the standard alphabet complement 
of the sequence HORSECHESTNUT, which forms the first half of that key Anthmetically, the 
sum of a letter of the first Hnlf and its homologous letter m the second half is 26 Thus 

H+T= 7+19=26=0 
0+M=14+12=26=0 
R+J=17+ 9=26=0 
S+I=18+ 8=26=0 
E+W= 4+22=26=0 

That IS, every letter of HORSECHESTNUT plus its homologous letter of the sequence 
TMJIWYTYIHNGH equals 26, wluch is hcic the same as zero In other words, the sequence 
TMJIWYTWIHNGH is, by cryptogiaphic aiithmetic, equivalent to “minus HORSECHESTNUT ” 
Therefore m Figure 17, encipher%ng the second half of each line by the key letters 
TMJIWYTWIHNGH (i e , addmg 19, 12, 9, 8, ) is the same as deciphering by the key letters 

HORSECHESTNUT (i e , subtracting 7, 14, 17, 18, ) For example 

Rp(TO=17+19=36=10=K, and 
r„(_HO=17-7=10=K 

Ep(Mk)=4+12=16=Qc, and 
Ep(-0k)=4-14=(26+4)-14=16=Qc, and so on 

e Refer now to Figure 15 The letters m the first half of Ime 1, beg innin g TMCWJ 
are identical with those m the first half of hne 1 of Figure 17 They must be identical because 
they are produced from identical elements The letters m the second half of this same hne m 
Figure 15, beginning KQLME were produced by deciphering the letters m the second Ime 
of Figure 10c Thus (taking for illustrative purposes only the first five letters m each case) 

KQLME = DCNIN-TMCWJ 
But DCNIN = RECEI + MYLEF 
And TMCWJ = MYLEF + H0RSE 
Hence, KQLME=(RECEI + MYLEF)-(MYLEF + HORSE) 
Or, KQLME = RECEI-H0RSE (1) 

As for the letters in the second half of hne 1 of Figure 17, also beginning KQLME , these 

letters were the result of enciphering RECEI by TMJIW 

Thus 

KQLME = RECEI + TMJIW 
But it has been shown m subparagraph d above that 

TMJIW = -H0RSE 

Hence, KQLME = RECEI+ (-HORSE) 

Or, KQLME = RECEI-H0RSE (2) 

Thus, equations (1) and (2) turn out to be identical but from what appear to be quite diverse 
sources 

y What has been demonstrated m connection with the letters m Ime 1 of Figures 15 and 
17 holds true for the letters m the other hues of these two figures, and it is not necessary to 
repeat the explanation The steps show that the ongmally aperiodic, auto-key cipher has been 
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converted, through a knowledge of the primary components, into a repeatmg-key cipher with a 
period twice the length of the mtroductory key The message may now he solved as an ordinary 
repeatmg-key cipher 

g ( 1 ) The foregoing case is based upon encipherment by the enciphenng equations 
0 it/ 2 =©i/i, ©prt =©«/2 When encipherment by the enciphenng equations 0 k/ 2 =Gi/i, ep/i= 0 j^, 
has been followed, the conversion of a plain-text auto-keyed cipher yields a repeatmg-key cipher 
with a penod equal to the length of the mtroductory key In this conversion, the enciphenng 
equations 6 k/ 2 = 0 |/i, 0 p/i= 0 o /2 are used m finding eqmvalents 

( 2 ) An example may be useful Note the encipherment of the followmg message by 
auto-key method by enciphenng equations 

T U E S D A Y| I NFORMATIONFROMRELIABLESOURCESINDIC 
INFORMATIONFROMRELIABLESOURCESINDICATESTHE 
PTBWOMCLVJZOFOTJQYDJNZNODMRBTOQZJRAWBWFQZC 

(3) If the message is written out in hnes conesponding to the length of the mtroductory 

key, and each hne is enciphered by the one directly above it, usmg the enciphenng equations 
©»/ 2 = 0 ifli 0p/i=©o/a m finding equivalents, the results are as shown m Figure 226 But if the 
same message is enciphered by equations usmg the word TUESDAY as a 

repeatmg key, the cipher text (Fig 18c) is identical with that obtamed m Figure 186 by encipher- 
mg each successive hne with the Ime above it 


Original cipher text 

P T B W 0 M C 

L V J Z 0 F 0 

T J Q Y D J N 

Z N 0 D M R B 

T 0 Q Z J R A 

ft B W F Q Z C 


Original cipher text Repeating key encipher 

and converted text ment 



T U E 

S 

DAY 


I 

N F 

0 

R M A 

P T B W 0 M C <- 

-► P 

T B 

w 

CMC 

L V J Z 0 F 0 






T 

I 0 

N 

FRO 

A 0 K V C R Q ^- 

-► A 

0 K 

V 

C R Q 

T J Q Y D J N 






M 

R E 

L 

I A B 

T X A T F A D «- 

-► T 

X A 

T 

FAD 

Z N 0 D M R B 






L 

E S 

0 

U R C 

S K 0 W R R E «- 

-- S 

K 0 

W 

R R E 

T 0 Q Z J R A 






E 

S I 

N 

DIG 

L Y E V A I E -- 

-► L 

Y E 

V 

A I E 

W B W F Q Z C 






A 

T E 

S 

THE 

H Z A A Q H G *- 

-- H 

Z A 

A 

Q H G 


Fiqvbk 18 


116 



(4) N ow note that the sequences ]omed by arrows m Figure 18 6 and c are identical and since 
It IS certain that Figure 18c is periodic in form because it was enciphered by the repeatmg-key 
method, it follows that Figure 186 is now also m periodic form, and m that form the message 
could be solved as though it were a repeatmg-key cipher 

h (1) In case of primary components consisting of a direct normal sequence shdmg agamst 
a reversed normal (U S Army disk), the process of convertmg the auto-key text to penodic 
terms is accomplished by usmg two direct normal sequences and “deciphering” each hne of the 
text (as transenbed m penods) by the hne above it For example, here is a message auto- 
enciphered by the aforementioned disk, with the imtial key word TUESDAY 
TUESDAYllNFORMATIONFROMRELIABLESOURCESINDIC 
INFORMATIONFROMRELIABLESOURCESINDICATESTHE 
LHZEMOYPFRBMVMHRKCXRNBNMXOJZHMKBRJAEZEVKBY 


(2) The cipher text is tianscnbed m penods equal to the length of the miUal key word 
(7 letters) and the 2d hne is “deciphered” with key letters of the 1st hne, usmg enciphenng 
equations 0k/a=0i/i, 0p/i=0c/a Ibe resultant letters are then used as key letters to “decipher” 
the 3d hne of text and so on Ihe results are as seen m Figure 196 Now let the ongmal mes¬ 
sage be eneiphered m repeatmg-key manner by the disk, with the key word TUESDAY, and the 
result IS Figure 19c Note that the odd or alternate lines of Figure 196 and c are identical, 
showing that the auto-key text has been converted mto repeatmg-key text 


and converted text 


TUESDAY 


I N F 0 R M A 


L H Z E 

M 0 Y -— 

-► L H Z E M 0 Y *- 

-. L H Z E M 0 Y 

P F R B 

M V M *- 

-• P F R B M V M 

T I 0 N F R 0 



A M Q F Y J K -- 

-► A M Q F Y J K 

H R K C 

X R N *— 

-- H R K C X R N 

H R E L I A B 



H D A H V A X ^- 

-► H D A H V A X 

B N M X 

0 J Z *— 

-- B N M X 0 J Z 

L E S 0 U R C 



I Q M E J J W '- 

-• I Q M E J J W 

H M K B 

R J A *— 

-► H M K B R J A 

E S I N D I C 



P C W F A S W -- 

-* P C W F A S W 

E Z E V 

K B Y «— 

-► E Z E V K B Y 

A T E S T H E 



T B A A K T U ‘- 

-• T B A A K T U 


i The foregomg procedures mdicate a simple method of solvmg ciphers of the foregoing 
types, when the primary components or the secondary cipher alphabets are known It consists 
m naaiiTTUTig introductory keys of various lengths, convertmg the cipher text mto repeatmg-key 
form, and then exammmg the resultmg diagrams for repetitions When a correct key length is 
assumed, repetitions will be as numerous as should be expected m ciphers of the repeatmg-key 
class, mcorrect assumptions for key length will not show so many repetitions 

] All the foregomg presupposes a knowledge of the cipher alphabets mvolved When these 
are unknown, recourse must be had to first pnnciples and the messages must be solved purely 
upon the basis of probable words, and repetitions, as outlmed m paragraphs 27-28 
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